T09 · Insecure Skill Coding Practices
Error
- Location
guides/03-advanced-usage.md:284- Finding
Hardcoded JWT Signing Key Allows Token Forgery
- Content
View full analysis
str: to_encode = {**data} expire = datetime.now(timezone.utc) + (expires_delta or timedelta(minutes=15)) to_encode.update({"exp": expire}) return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]) -> User: credentials_exception = HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="Could not validate credentials", headers={"WWW-Authenticate": "Bearer"}, ) try: payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) username: str = payload.get("sub") if username is None: raise credentials_exception token_data = TokenData(username=username) except jwt.InvalidTokenError: raise credentials_exception user = get_user(fake_users_db, username=token_data.username) if user is None: raise credentials_exception return user ``` ### Technical Analysis The guide describes itself as suitable for building production-grade FastAPI applications and states that the AI can generate authentication code. The JWT implementation uses HS256, a symmetric signature algorithm for which token issuers and validators share the same secret. Because the signing key is embedded directly in publicly distributed guidance, an application generated from this example may retain a key known to every reader of the Skill. Possession of the key permits an attacker to create crypt ...[truncated 1396 chars]- Remediation
View remediation