Michael/podcastic
1
0 Fork 0
mirror of https://github.com/R0m1k3/podcastic.git synced 2026-10-19 13:08:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: require strong JWT_SECRET at boot, no fallback

Browse Source 
Reject startup if JWT_SECRET is missing, shorter than 32 chars, or set to
known weak defaults. Prevents production from running with predictable
signing keys.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
MichaelandClaude Haiku 4.5 committed 2026-04-18 07:25:19 +02:00
1 parent 01c179c68b
commit 0af3b3f975
1 file changed
+7 -1
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/utils/jwt.ts
+7 -1
View File
@@ -3,7 +3,13 @@ import { IUser } from '../models/User';
import type { SignOptions } from 'jsonwebtoken';
const JWT_SECRET = process.env.JWT_SECRET || 'dev_secret_key';
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET || JWT_SECRET.length < 32 || JWT_SECRET === 'change_me_in_production' || JWT_SECRET === 'dev_secret_key') {
throw new Error(
'JWT_SECRET must be set to a strong value (min 32 chars). Generate one with: openssl rand -base64 32'
);
}
const JWT_EXPIRES_IN = (process.env.JWT_EXPIRES_IN || '7d') as SignOptions['expiresIn'];
const JWT_REFRESH_EXPIRES_IN = (process.env.JWT_REFRESH_EXPIRES_IN || '30d') as SignOptions['expiresIn'];