[Bug][Medium] Server boots with no JWT_SECRET (only a warning) #14

New Issue

wtclaude · 2026-07-02T01:20:46Z

wtclaude commented

2026-07-02 01:20:46 +00:00

Severity: Medium (Low in dev) · Type: Bug / hardening

Problem

server/src/utils/auth.js:10-12 only logs a warning when JWT_SECRET is unset, then continues to start. With no secret, jwt.verify throws for every request (so login is silently unusable), and running without a configured secret is a production-safety hazard.

Suggested fix

Fail fast in production when the secret is missing:

if (!JWT_SECRET) {
  if (process.env.NODE_ENV === 'production') throw new Error('JWT_SECRET must be set')
  log.warn('JWT_SECRET is not set — using dev fallback')
}

(Or always throw — the app is unusable without it anyway.)

**Severity:** Medium (Low in dev) · **Type:** Bug / hardening ## Problem `server/src/utils/auth.js:10-12` only logs a warning when `JWT_SECRET` is unset, then continues to start. With no secret, `jwt.verify` throws for every request (so login is silently unusable), and running without a configured secret is a production-safety hazard. ## Suggested fix Fail fast in production when the secret is missing: ```js if (!JWT_SECRET) { if (process.env.NODE_ENV === 'production') throw new Error('JWT_SECRET must be set') log.warn('JWT_SECRET is not set — using dev fallback') } ``` (Or always throw — the app is unusable without it anyway.)

whitlocktech added the

bug

label 2026-07-03 02:45:52 +00:00

wtclaude referenced this issue from a commit

2026-07-03 05:55:18 +00:00

Fail fast when JWT_SECRET is missing in production (#14)

wtclaude referenced a pull request that will close this issue

2026-07-03 05:56:12 +00:00

Fail fast when JWT_SECRET is missing in production (closes #14) #21

whitlocktech closed this issue

2026-07-03 05:58:18 +00:00

whitlocktech referenced this issue from a commit