The Fiber JWT middleware (gofiber/contrib/jwt) is configured with a hardcoded string-literal signing key (SigningKey: jwtware.SigningKey{Key: []byte("...")}).

Why this matters

This key verifies every request token; committed to source it lets anyone forge a valid JWT for any user or role, a complete authentication bypass (CWE-798). LLMs commonly inline []byte("secret") so the middleware "just works".

Load the key from configuration or a secret store: app.Use(jwtware.New(jwtware.Config{ SigningKey: jwtware.SigningKey{Key: []byte(os.Getenv("JWT_SECRET"))}, })) Rotate any key already committed.

package main

import (
	jwtware "github.com/gofiber/contrib/jwt"
	"github.com/gofiber/fiber/v2"
)

func setup(app *fiber.App) {
	// ruleid: auth.go.jwt.fiber-hardcoded-key
	app.Use(jwtware.New(jwtware.Config{
		SigningKey: jwtware.SigningKey{Key: []byte("hardcoded-fiber-jwt-secret")},
	}))
}

package main

import (
	"os"

	jwtware "github.com/gofiber/contrib/jwt"
	"github.com/gofiber/fiber/v2"
)

func setupSafe(app *fiber.App) {
	// Key from the environment: not a literal, not flagged.
	app.Use(jwtware.New(jwtware.Config{
		SigningKey: jwtware.SigningKey{Key: []byte(os.Getenv("JWT_SECRET"))},
	}))
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.go.jwt.fiber-hardcoded-key -- <reason>

References