Skip to content

FMSG_JWT_SECRET required, decode base64#3

Merged
markmnl merged 3 commits intomainfrom
jwt-improvements
Apr 18, 2026
Merged

FMSG_JWT_SECRET required, decode base64#3
markmnl merged 3 commits intomainfrom
jwt-improvements

Conversation

@markmnl
Copy link
Copy Markdown
Owner

@markmnl markmnl commented Apr 18, 2026

No description provided.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR makes FMSG_JWT_SECRET mandatory for JWT signing/verification and adds support for supplying the secret as base64 (decoded to raw bytes) to avoid relying on an unsafe built-in development fallback.

Changes:

  • Remove the hardcoded development JWT signing secret fallback and require FMSG_JWT_SECRET.
  • Decode FMSG_JWT_SECRET from base64 when applicable; otherwise use the raw string bytes.
  • Update README configuration table to reflect that FMSG_JWT_SECRET is required.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
internal/auth/token.go Enforces required JWT secret and adds optional base64 decoding before signing/parsing tokens.
README.md Updates documented default for FMSG_JWT_SECRET to required.

Comment thread internal/auth/token.go Outdated
Comment thread README.md
@markmnl markmnl merged commit 5660471 into main Apr 18, 2026
Copilot stopped work on behalf of markmnl due to an error April 18, 2026 03:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants