HIGH AI PREVALENCE: HIGH auth.py.jwt.hardcoded-secret

A JWT signing/verification key is hardcoded as a string literal in the call to PyJWT.

CWE-798 OWASP API2:2023 python

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

Anyone who can read the source or git history can forge or tamper with tokens, which is a complete authentication bypass.

Load the secret from the environment or a secret manager instead, e.g. key = os.environ["JWT_SECRET"] and jwt.encode(payload, key, ...). Never commit signing keys to source control.

VULNERABLE

vulnerable.py

import jwt


def sign(payload: dict):
    # ruleid: auth.py.jwt.hardcoded-secret
    return jwt.encode(payload, "super-secret-key")


def sign_with_alg(payload: dict):
    # ruleid: auth.py.jwt.hardcoded-secret
    return jwt.encode(payload, "super-secret-key", algorithm="HS256")


def verify(token: str):
    # ruleid: auth.py.jwt.hardcoded-secret
    return jwt.decode(token, "super-secret-key", algorithms=["HS256"])

SAFE

safe.py

import os

import jwt
from django.conf import settings


def sign_from_env(payload: dict):
    # ok: auth.py.jwt.hardcoded-secret
    return jwt.encode(payload, os.environ["JWT_SECRET"], algorithm="HS256")


def sign_from_settings(payload: dict):
    # ok: auth.py.jwt.hardcoded-secret
    return jwt.encode(payload, settings.SECRET_KEY, algorithm="HS256")


def verify_with_variable(token: str):
    key = os.environ["JWT_SECRET"]
    # ok: auth.py.jwt.hardcoded-secret
    return jwt.decode(token, key, algorithms=["HS256"])

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.jwt.hardcoded-secret -- <reason>

References

https://pyjwt.readthedocs.io/en/stable/api.html#jwt.encode ↗https://cwe.mitre.org/data/definitions/798.html ↗