JWT secret hardcoded

Code reviewSecurityMid–Senior~15 min

Review this Java service that signs JWTs.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 15 min

Mark a line and say what kind of problem it is.0 findings

1public class TokenService {

2 private static final String JWT_SECRET = "s3cr3t-prod-signing-key-2021";

3 private static final String AWS_KEY = "AKIAIOSFODNN7EXAMPLE";

5 public String issue(String userId) {

6 return Jwts.builder()

7 .setSubject(userId)

8 .setExpiration(new Date(System.currentTimeMillis() + 86400000))

9 .signWith(SignatureAlgorithm.HS256, JWT_SECRET.getBytes())

10 .compact();

11 }

12}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.