Skip to content

Fix Weak JWT Signing Key #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JBHook wants to merge 1 commit into
base: dc34-ctf
Choose a base branch
from
Open

Fix Weak JWT Signing Key #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import os
import secrets
import connexion
from flask import jsonify
from flask_sqlalchemy import SQLAlchemy
Expand All @@ -10,7 +11,11 @@
vuln_app.app.config['SQLALCHEMY_DATABASE_URI'] = SQLALCHEMY_DATABASE_URI
vuln_app.app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False

vuln_app.app.config['SECRET_KEY'] = 'random'
# The JWT signing key must be a high-entropy secret - a short, guessable value like "random"
# lets an attacker offline-brute-force it and forge arbitrary auth tokens (including for the
# admin account). Falls back to a securely random 256-bit key generated at process start if the
# deployment doesn't provide its own via the environment.
vuln_app.app.config['SECRET_KEY'] = os.getenv('SECRET_KEY') or secrets.token_hex(32)
# start the db
db = SQLAlchemy(vuln_app.app)

Expand Down
Loading