JWT secret hardcoded in fallback

Code reviewSecurityMid–Senior~18 min

Review this Node config module for the JWT signing secret.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 18 min

Mark a line and say what kind of problem it is.0 findings

1const jwt = require('jsonwebtoken');

3const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret-change-me';

5function sign(payload) {

6 return jwt.sign(payload, JWT_SECRET, { algorithm: 'HS256', expiresIn: '7d' });

9function verify(token) {

10 return jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] });

11}

13module.exports = { sign, verify, JWT_SECRET };

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.