v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.fastify.jwt-hardcoded-secret

@fastify/jwt is registered with a hard-coded secret string literal.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This key signs and verifies every token: committed to git it is one search away from compromise, letting an attacker forge tokens for any user.

Load it from the environment instead (fastify.register(fastifyJwt, { secret: process.env.JWT_SECRET })) and add the variable to .env.example with a placeholder. Rotate the leaked value out of source control. For asymmetric signing pass a key pair ({ private, public }) read from files or a secret manager, not inline.

VULNERABLE
vulnerable.ts
import Fastify from 'fastify';
import fastifyJwt from '@fastify/jwt';

const fastify = Fastify();

// ruleid: auth.fastify.jwt-hardcoded-secret
fastify.register(fastifyJwt, { secret: 'super-secret-signing-key' });

const app = Fastify();
// ruleid: auth.fastify.jwt-hardcoded-secret
app.register(require('@fastify/jwt'), {
  secret: 'another-hardcoded-key',
  sign: { expiresIn: '10m' },
});
SAFE
safe.ts
import Fastify from 'fastify';
import fastifyJwt from '@fastify/jwt';
import { readFileSync } from 'node:fs';

const fastify = Fastify();

// ok: auth.fastify.jwt-hardcoded-secret -- secret read from the environment
fastify.register(fastifyJwt, { secret: process.env.JWT_SECRET });

const app = Fastify();
// ok: auth.fastify.jwt-hardcoded-secret -- asymmetric key pair loaded from disk
app.register(fastifyJwt, {
  secret: {
    private: readFileSync('private.pem'),
    public: readFileSync('public.pem'),
  },
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.fastify.jwt-hardcoded-secret -- <reason>

References

https://github.com/fastify/fastify-jwt#usage ↗https://cwe.mitre.org/data/definitions/798.html ↗