Security: Hardcoded fallback JWT secret exposes authentication to forgery

[Siddh2024]

Summary

RestroHub/src/main/resources/application.properties:73 sets a default JWT secret your-256-bit-secret-key-here-change-in-production. If JWT_SECRET env var is not set, all JWT tokens are signed with this known public key. Combined with spring.jpa.hibernate.ddl-auto=update, an attacker with a forged JWT can manipulate the database schema via Hibernate.

Details

• File: RestroHub/src/main/resources/application.properties line 73
• Default: security.jwt.secret=your-256-bit-secret-key-here-change-in-production
• File: JwtTokenProvider.java line 30 -- fallback reads the properties value
• File: �pplication.properties line 31 -- spring.jpa.hibernate.ddl-auto=update

Impact

Any attacker can forge valid JWTs and impersonate any user, including admins. The Hibernate auto-update setting means schema manipulation via forged tokens is also possible.

Suggested Fix

1. Remove the default secret value -- require it to be set via environment variable
2. Add a startup check that fails if the secret is the default value
3. Consider disabling ddl-auto=update in production