69 lines
1.8 KiB
Plaintext
69 lines
1.8 KiB
Plaintext
|
include::../../../shared_content/secrets/description.adoc[]
|
||
|
|
|
||
|
|
== Why is this an issue?
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/rationale.adoc[]
|
||
|
|
|
||
|
|
=== What is the potential impact?
|
||
|
|
|
||
|
|
If a JWT secret key leaks to an unintended audience, it can have serious
|
||
|
|
security implications for the corresponding application. The secret key is used
|
||
|
|
to encode and decode JWTs when using a symmetric signing algorithm, and an
|
||
|
|
attacker could potentially use it to perform malicious actions.
|
||
|
|
|
||
|
|
For example, an attacker could use the secret key to create their own
|
||
|
|
authentication tokens that appear to be legitimate, allowing them to bypass
|
||
|
|
authentication and gain access to sensitive data or functionality.
|
||
|
|
|
||
|
|
In the worst-case scenario, an attacker could be able to execute arbitrary code
|
||
|
|
on the application by abusing administrative features, and take over its hosting
|
||
|
|
server.
|
||
|
|
|
||
|
|
== How to fix it
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/fix/revoke.adoc[]
|
||
|
|
|
||
|
|
Changing the secret value is sufficient to invalidate any data that it protected.
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/fix/vault.adoc[]
|
||
|
|
|
||
|
|
=== Code examples
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
[source,python,diff-id=1,diff-type=noncompliant,subs="attributes"]
|
||
|
|
----
|
||
|
|
from flask import Flask
|
||
|
|
|
||
|
|
app = Flask(__name__)
|
||
|
|
app.config['JWT_SECRET_KEY'] = "secret" # Noncompliant
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant solution
|
||
|
|
|
||
|
|
[source,python,diff-id=1,diff-type=compliant,subs="attributes"]
|
||
|
|
----
|
||
|
|
from flask import Flask
|
||
|
|
import os
|
||
|
|
|
||
|
|
app = Flask(__name__)
|
||
|
|
app.config['JWT_SECRET_KEY'] = os.environ["JWT_SECRET_KEY"]
|
||
|
|
----
|
||
|
|
|
||
|
|
|
||
|
|
//=== How does this work?
|
||
|
|
|
||
|
|
//=== Pitfalls
|
||
|
|
|
||
|
|
//=== Going the extra mile
|
||
|
|
|
||
|
|
== Resources
|
||
|
|
|
||
|
|
include::../../../shared_content/secrets/resources/standards.adoc[]
|
||
|
|
|
||
|
|
=== Documentation
|
||
|
|
|
||
|
|
* Flask JWT documentation - https://flask-jwt-extended.readthedocs.io/en/stable/options.html#jwt-secret-key[Config - JWT_SECRET_KEY]
|
||
|
|
|
||
|
|
//=== Benchmarks
|