Fix hardcoded jwt string and replaced jwt.decode to jwt.verify #59

manunio · 2022-07-04T12:48:50Z

Fix: removed hardcoded jwt secret const serect = 'token'; and made it configurable by config.js.
Fix: The invisible character U+00a0 in user.js
Update: changed jwt.decode to jwt.verify as decode does not validate signature.

Fix: removed hardcoded jwt secret and made it configurable by config.js Update: changed jwt.decode to jwt.verify as decode does not validate signature

Fix hardcoded jwt string and replaced jwt.decode to jwt.verify

7e886fd

Fix: removed hardcoded jwt secret and made it configurable by config.js Update: changed jwt.decode to jwt.verify as decode does not validate signature

manunio mentioned this pull request Jul 4, 2022

Use of Hard-coded Cryptographic Key vulnerability. #60

Closed

wangyuan389 merged commit 681d595 into wangyuan389:master Jul 5, 2022

manunio deleted the fix-hardcoded-jwt-secret branch July 5, 2022 11:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix hardcoded jwt string and replaced jwt.decode to jwt.verify #59

Fix hardcoded jwt string and replaced jwt.decode to jwt.verify #59

manunio commented Jul 4, 2022 •

edited

Loading

Fix hardcoded jwt string and replaced jwt.decode to jwt.verify #59

Fix hardcoded jwt string and replaced jwt.decode to jwt.verify #59

Conversation

manunio commented Jul 4, 2022 • edited Loading

manunio commented Jul 4, 2022 •

edited

Loading