From f93ef3c3b387320dcc0e6d5abfedfdef8c8a2440 Mon Sep 17 00:00:00 2001
From: beanbeah <24713371+beanbeah@users.noreply.github.com>
Date: Sun, 9 Aug 2026 06:17:48 -0700
Subject: [PATCH] fix(challenge-9): remove hardcoded JWT signing key

SECRET_KEY was a fixed literal ('random') committed to source, so anyone
could forge valid auth tokens offline for any username (including admin)
without ever logging in.

Now the key is sourced from the SECRET_KEY environment variable when the
operator provides one, and otherwise falls back to a securely-generated
random key per process (secrets.token_hex(32)) so there is never a
shared, guessable default baked into the repo.

Verified locally: a token forged with the old hardcoded key 'random' is
now rejected with 401 Invalid token, while tokens issued by the running
app's own /login endpoint continue to authenticate normally.
---
 config.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/config.py b/config.py
index 17e65c5..5f807d8 100644
--- a/config.py
+++ b/config.py
@@ -1,4 +1,5 @@
 import os
+import secrets
 import connexion
 from flask import jsonify
 from flask_sqlalchemy import SQLAlchemy
@@ -10,7 +11,12 @@
 vuln_app.app.config['SQLALCHEMY_DATABASE_URI'] = SQLALCHEMY_DATABASE_URI
 vuln_app.app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
 
-vuln_app.app.config['SECRET_KEY'] = 'random'
+# JWT signing key must never be a fixed literal shipped in source: a hardcoded key lets
+# anyone forge auth tokens offline for any user (including admin) without ever logging in.
+# Prefer an operator-supplied secret (e.g. injected via environment/secret manager); fall
+# back to a securely-generated random key per process so there is no shared, guessable
+# default even when no override is configured.
+vuln_app.app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY') or secrets.token_hex(32)
 # start the db
 db = SQLAlchemy(vuln_app.app)