> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/leakage-of-hard-coded-secret-in-jwt.md).

# Leakage of hard-coded secret in JWT

## Overview

* **Rule ID**: `javascript_lang_jwt_hardcoded_secret`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-798

## Description

Storing hard-coded secrets in your code, particularly for JSON Web Tokens (JWT), poses a significant security risk. This practice exposes your application to unauthorized access and attacks.

## Remediation Guidelines

* **Avoid hard-coding secrets in your code.** Hard-coding makes sensitive information easily accessible to anyone who can view the code.
* **Use environment variables to store sensitive information such as secrets.** This approach keeps credentials out of your codebase and facilitates more secure management.

  ```javascript
  var jwt = require("jsonwebtoken");
  var token = jwt.sign({ foo: "bar" }, process.env.JWT_SECRET);

  ```
* **Consider implementing a key-management system** to securely handle secrets and other sensitive information. This method provides enhanced security measures for managing and accessing credentials.

## References

* [**OWASP hardcoded passwords**](https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password)
* [**CWE-798: Use of Hard-coded Credentials**](https://cwe.mitre.org/data/definitions/798.html)
* [**OWASP Top 10: A07:2021 - Identification and Authentication Failures**](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)