cybertec-postgresql / pgwatch / 30345388496

74%

master: 86%

push

github

[-] use random JWT secret instead of hardcoded key (#1475)

The Web UI/API signed and validated all JWTs with a hardcoded key
published in the source, letting anyone forge accepted tokens and
bypass authentication.

Generate a random 32-byte HS256 key at startup via `crypto/rand`.
Tokens now rotate on every restart, invalidating leaked ones.

7 of 10 new or added lines in 1 file covered. (70.0%)

3694 of 5001 relevant lines covered (73.87%)

0.84 hits per line