Code reviewMediumcr-g549

Subject Security hardcoded secretLevel Mid–Senior~15 minCommon in Security interviewsIndustries Software development, Technology

Question

Review this Java service that signs JWTs.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1public class TokenService {2    private static final String JWT_SECRET = "s3cr3t-prod-signing-key-2021";3    private static final String AWS_KEY = "AKIAIOSFODNN7EXAMPLE";4 5    public String issue(String userId) {6        return Jwts.builder()7            .setSubject(userId)8            .setExpiration(new Date(System.currentTimeMillis() + 86400000))9            .signWith(SignatureAlgorithm.HS256, JWT_SECRET.getBytes())10            .compact();11    }12}

Run or narrate your approach, then ask the coach.