cybertec-postgresql / pgwatch / 30345367548

84%

master: 86%

Build Type

push

github

Committed by pashagolub

Commit Message

[-] use random JWT secret instead of hardcoded key (#1475)

The Web UI/API signed and validated all JWTs with a hardcoded key
published in the source, letting anyone forge accepted tokens and
bypass authentication.

Generate a random 32-byte HS256 key at startup via `crypto/rand`.
Tokens now rotate on every restart, invalidating leaked ones.

Coverage Stats

7 of 10 new or added lines in 1 file covered. (70.0%)

4 existing lines in 1 file now uncovered.

4510 of 5342 relevant lines covered (84.43%)

0.96 hits per line