HIGH AI PREVALENCE: HIGH auth.csharp.jwt.hardcoded-symmetric-key

A JWT signing key is built from a hard-coded string literal (`new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))`).

CWE-798 OWASP API2:2023 C#

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This key signs and verifies every token: committed to source control it is one search away from compromise, letting an attacker forge tokens for any user or role (CWE-798). This is a common AI-generated mistake: a literal secret is inlined to make the sample "just work" and never externalized.

Load the key from configuration or a secret store instead (e.g. Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]) or a value read from Azure Key Vault / environment) and rotate the leaked secret out of source control.

VULNERABLE

vulnerable.cs

using System.Text;
using Microsoft.IdentityModel.Tokens;

public class TokenService
{
    public SecurityKey BuildUtf8Key()
    {
        // ruleid: auth.csharp.jwt.hardcoded-symmetric-key
        return new SymmetricSecurityKey(Encoding.UTF8.GetBytes("s3cr3t-signing-key-value-9a8b7c"));
    }

    public SecurityKey BuildAsciiKey()
    {
        // ruleid: auth.csharp.jwt.hardcoded-symmetric-key
        return new SymmetricSecurityKey(Encoding.ASCII.GetBytes("another-hardcoded-secret-01234"));
    }
}

SAFE

safe.cs

using System;
using System.Text;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;

public class TokenService
{
    private readonly IConfiguration _config;

    public TokenService(IConfiguration config)
    {
        _config = config;
    }

    public SecurityKey FromConfig()
    {
        return new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
    }

    public SecurityKey FromEnvironment()
    {
        return new SymmetricSecurityKey(
            Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("JWT_SIGNING_KEY")));
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.jwt.hardcoded-symmetric-key -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/app-secrets ↗https://cwe.mitre.org/data/definitions/798.html ↗

A JWT signing key is built from a hard-coded string literal (new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))).

Why this matters

Suppressing this rule

References

A JWT signing key is built from a hard-coded string literal (`new SymmetricSecurityKey(Encoding.UTF8.GetBytes("..."))`).