The Echo JWT middleware (labstack/echo-jwt) is configured with a hardcoded string-literal SigningKey.

Why this matters

This key verifies every request token; committed to source it lets anyone forge a valid JWT for any user or role, a complete authentication bypass (CWE-798). An empty key ([]byte("")) is worse still. It accepts trivially forged tokens. LLMs commonly inline []byte("secret") so the middleware "just works".

Load the key from configuration or a secret store: e.Use(echojwt.WithConfig(echojwt.Config{ SigningKey: []byte(os.Getenv("JWT_SECRET")), })) Rotate any key already committed.

package main

import (
	echojwt "github.com/labstack/echo-jwt/v4"
	"github.com/labstack/echo/v4"
)

func setup(e *echo.Echo) {
	// ruleid: auth.go.jwt.echojwt-hardcoded-key
	e.Use(echojwt.WithConfig(echojwt.Config{
		SigningKey: []byte("hardcoded-echo-jwt-secret"),
	}))

	// ruleid: auth.go.jwt.echojwt-hardcoded-key
	e.Use(echojwt.WithConfig(echojwt.Config{SigningKey: []byte("")}))
}

package main

import (
	"os"

	echojwt "github.com/labstack/echo-jwt/v4"
	"github.com/labstack/echo/v4"
)

func setupSafe(e *echo.Echo) {
	// Key from the environment: not a literal, not flagged.
	e.Use(echojwt.WithConfig(echojwt.Config{
		SigningKey: []byte(os.Getenv("JWT_SECRET")),
	}))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.jwt.echojwt-hardcoded-key -- <reason>

References