Skip to content

🔒 fix: Remove hardcoded JWT secret #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnyTng wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🔒 fix: Remove hardcoded JWT secret #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions backend/RESTful API/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,12 @@
var builder = WebApplication.CreateBuilder(args);

// Configurar JWT
var key = Encoding.ASCII.GetBytes(
builder.Configuration["JwtSettings:Secret"] ?? "chave-super-secreta");
var jwtSecret = builder.Configuration["JwtSettings:Secret"];
if (string.IsNullOrEmpty(jwtSecret) || jwtSecret == "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS" || jwtSecret.Length < 32)
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 characters long and not the default placeholder.");
}
Comment on lines +19 to +23

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The secret validation uses string.IsNullOrEmpty and doesn’t trim whitespace, so a value like " ..." (or an env var with trailing newline) can pass the check and be used as the signing key. Consider switching to IsNullOrWhiteSpace and validating against a trimmed value before comparing to the placeholder and checking length.

Suggested change
var jwtSecret = builder.Configuration["JwtSettings:Secret"];
if (string.IsNullOrEmpty(jwtSecret) || jwtSecret == "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS" || jwtSecret.Length < 32)
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 characters long and not the default placeholder.");
}
var jwtSecretRaw = builder.Configuration["JwtSettings:Secret"];
if (string.IsNullOrWhiteSpace(jwtSecretRaw))
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 characters long and not the default placeholder.");
}
var jwtSecret = jwtSecretRaw.Trim();
if (jwtSecret == "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS" || jwtSecret.Length < 32)
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 characters long and not the default placeholder.");
}

Copilot uses AI. Check for mistakes.
var key = Encoding.ASCII.GetBytes(jwtSecret);
Comment on lines +20 to +24

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Encoding the secret with Encoding.ASCII can silently replace non-ASCII characters with '?', potentially changing the configured secret and reducing entropy. Consider using UTF-8 and enforcing the minimum key size based on byte length (e.g., 32 bytes) rather than string character count.

Suggested change
if (string.IsNullOrEmpty(jwtSecret) || jwtSecret == "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS" || jwtSecret.Length < 32)
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 characters long and not the default placeholder.");
}
var key = Encoding.ASCII.GetBytes(jwtSecret);
if (string.IsNullOrEmpty(jwtSecret) || jwtSecret == "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS")
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret and not use the default placeholder.");
}
var key = Encoding.UTF8.GetBytes(jwtSecret);
if (key.Length < 32)
{
throw new InvalidOperationException("A valid JWT Secret must be configured in JwtSettings:Secret. The secret must be at least 32 bytes long when encoded as UTF-8.");
}

Copilot uses AI. Check for mistakes.

// Connection string
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
Expand Down
2 changes: 1 addition & 1 deletion backend/RESTful API/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
"AllowedHosts": "*",

"JwtSettings": {
"Secret": "S3gr3d0SuperSeguroComMaisDe32Caracteres"
"Secret": "YOUR_JWT_SECRET_KEY_HERE_MIN_32_CHARS"
},

"ConnectionStrings": {
Expand Down