v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: HIGH auth.php.secret.hardcoded-jwt-key

A JWT signing key is a hard-coded string literal, passed to JWT::encode() / new Key() (firebase/php-jwt) or InMemory::plainText() / InMemory::base64Encoded() (lcobucci/jwt).

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

This key signs and verifies every token: committed to source control it is one search away from compromise, letting an attacker forge a token for any user or role (CWE-798). AI-generated samples inline the secret to make the snippet "just work" and it ships unchanged.

Read the key from the environment or a secret store instead: JWT::encode($payload, $_ENV['JWT_SECRET'], 'HS256'); new Key(getenv('JWT_SECRET'), 'HS256');

VULNERABLE
vulnerable.php
<?php

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Lcobucci\JWT\Signer\Key\InMemory;

function issue(array $payload): string
{
    // ruleid: auth.php.secret.hardcoded-jwt-key
    return JWT::encode($payload, "super-secret-value", 'HS256');
}

function verify(string $jwt)
{
    // ruleid: auth.php.secret.hardcoded-jwt-key
    return JWT::decode($jwt, new Key("super-secret-value", 'HS256'));
}

function lcobucci_plain()
{
    // ruleid: auth.php.secret.hardcoded-jwt-key
    return InMemory::plainText("hardcoded-hmac-key");
}

function lcobucci_b64()
{
    // ruleid: auth.php.secret.hardcoded-jwt-key
    return InMemory::base64Encoded("aGFyZGNvZGVka2V5");
}
SAFE
safe.php
<?php

use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Lcobucci\JWT\Signer\Key\InMemory;

function issue(array $payload): string
{
    // ok: key read from the environment
    return JWT::encode($payload, $_ENV['JWT_SECRET'], 'HS256');
}

function verify(string $jwt)
{
    // ok: key read via getenv()
    return JWT::decode($jwt, new Key(getenv('JWT_SECRET'), 'HS256'));
}

function lcobucci_env()
{
    // ok: key read from config()
    return InMemory::base64Encoded(config('jwt.secret'));
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.php.secret.hardcoded-jwt-key -- <reason>

References

https://github.com/firebase/php-jwt ↗https://github.com/lcobucci/jwt ↗https://cwe.mitre.org/data/definitions/798.html ↗