search

AkiraBrown / rc_test_part_2

Part 2 of Red Canary Take Home work (Detection Engineer)
0 stars 0 forks source link

Bug(server/app.js): Secret is improperly stored #2

Closed AkiraBrown closed 6 days ago

AkiraBrown commented 1 week ago

On line 7 the secret used to sign tokens is improperly stored which poses a risk to users' JWT tokens. All created JWT tokens use the secret to apply a signature on the token and verify that it's a genuine token.

AkiraBrown commented 6 days ago

Fix

Removed secret from string variable and used "dotenv" package to pull environment variables from .env file.