Description: Hardcoding the JWT secret key can lead to arbitrary users spoofing tokens. Since the travels-java-api is an open-source project, others can easily obtain the JWT secret key of travels-java-api. This allows them to use the JWT secret key to generate arbitrary JWT tokens and gain access to any user's permissions.
Fix Suggestion: Generate a random JWT secret key during project initialization and store it in the database.
test code:
file:
travels-java-api-master\src\main\java\io\github\mariazevedo88\travelsjavaapi\filters\JwtAuthenticationTokenFilter.java
Description: Hardcoding the JWT secret key can lead to arbitrary users spoofing tokens. Since the travels-java-api is an open-source project, others can easily obtain the JWT secret key of travels-java-api. This allows them to use the JWT secret key to generate arbitrary JWT tokens and gain access to any user's permissions.
Fix Suggestion: Generate a random JWT secret key during project initialization and store it in the database.
test code:
file:
travels-java-api-master\src\main\java\io\github\mariazevedo88\travelsjavaapi\filters\JwtAuthenticationTokenFilter.java