From fb57c479079e7233a13122d16b4b7b65675098a5 Mon Sep 17 00:00:00 2001 From: JBHook <314778749+JBHook@users.noreply.github.com> Date: Sun, 9 Aug 2026 04:46:58 +0000 Subject: [PATCH] Fix Weak JWT Signing Key The JWT signing secret was hardcoded to the literal string "random" - a trivially guessable/brute-forceable key, letting an attacker forge arbitrary valid auth tokens (including for the admin account) entirely offline, without ever needing valid credentials. Replaced it with a securely random 256-bit key generated via secrets.token_hex(32) at process start, with an optional SECRET_KEY environment variable override for deployments that want to pin a fixed key (e.g. across multiple app instances). Verified live: normal login/auth still works end-to-end (login as "name1", use the returned token against /me). Forged a token signed with the old hardcoded secret "random" for the admin user using PyJWT directly - the app now rejects it with "Invalid token. Please log in again." instead of accepting it as a valid admin session. Co-Authored-By: Claude Sonnet 5 --- config.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/config.py b/config.py index 17e65c5..5a88050 100644 --- a/config.py +++ b/config.py @@ -1,4 +1,5 @@ import os +import secrets import connexion from flask import jsonify from flask_sqlalchemy import SQLAlchemy @@ -10,7 +11,11 @@ vuln_app.app.config['SQLALCHEMY_DATABASE_URI'] = SQLALCHEMY_DATABASE_URI vuln_app.app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False -vuln_app.app.config['SECRET_KEY'] = 'random' +# The JWT signing key must be a high-entropy secret - a short, guessable value like "random" +# lets an attacker offline-brute-force it and forge arbitrary auth tokens (including for the +# admin account). Falls back to a securely random 256-bit key generated at process start if the +# deployment doesn't provide its own via the environment. +vuln_app.app.config['SECRET_KEY'] = os.getenv('SECRET_KEY') or secrets.token_hex(32) # start the db db = SQLAlchemy(vuln_app.app)