Code reviewMediumcr-g449

Subject Hardcoded secretsLevel Mid–Senior~18 minCommon in Security interviewsIndustries Software development, Technology

Question

Review this Node config module for the JWT signing secret.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjs

1const jwt = require('jsonwebtoken');2 3const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret-change-me';4 5function sign(payload) {6  return jwt.sign(payload, JWT_SECRET, { algorithm: 'HS256', expiresIn: '7d' });7}8 9function verify(token) {10  return jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] });11}12 13module.exports = { sign, verify, JWT_SECRET };

Run or narrate your approach, then ask the coach.