From baa9a30ddfb3efe99e34b0a885c14b4a015cce0e Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 14 Jul 2026 10:49:00 +0530 Subject: [PATCH] fix: fail startup when JWT secret uses insecure default (#291) Co-authored-by: Cursor --- .../restroly/qrmenu/security/JwtTokenProvider.java | 11 +++++++++++ RestroHub/src/main/resources/application.properties | 1 + 2 files changed, 12 insertions(+) diff --git a/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java b/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java index a29252f1..bdeffc80 100644 --- a/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java +++ b/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java @@ -22,6 +22,9 @@ @Slf4j public class JwtTokenProvider { + private static final String INSECURE_DEFAULT_SECRET = + "your-256-bit-secret-key-here-change-in-production"; + @Value("${security.jwt.secret}") private String jwtSecret; @@ -35,6 +38,14 @@ public class JwtTokenProvider { @PostConstruct public void init() { + if (jwtSecret == null || jwtSecret.isBlank()) { + throw new IllegalStateException( + "JWT secret must be configured via the JWT_SECRET environment variable."); + } + if (INSECURE_DEFAULT_SECRET.equals(jwtSecret)) { + throw new IllegalStateException( + "JWT secret is using the insecure default value. Set JWT_SECRET to a secure random key."); + } this.key = Keys.hmacShaKeyFor(jwtSecret.getBytes(StandardCharsets.UTF_8)); } diff --git a/RestroHub/src/main/resources/application.properties b/RestroHub/src/main/resources/application.properties index e812b174..38ff8eaf 100644 --- a/RestroHub/src/main/resources/application.properties +++ b/RestroHub/src/main/resources/application.properties @@ -86,6 +86,7 @@ api.license.url=https://www.apache.org/licenses/LICENSE-2.0 # =============================== # Security / JWT # =============================== +# Set JWT_SECRET in production; startup fails if the insecure default is used. security.jwt.secret=${JWT_SECRET:your-256-bit-secret-key-here-change-in-production} security.jwt.expiration=${JWT_EXPIRATION:86400000} security.jwt.refresh-expiration=${JWT_REFRESH_EXPIRATION:604800000}