Description

This vulnerability detector identifies hardcoded secrets used to build JWT signing and verification keys in Rust applications that rely on the jsonwebtoken library. A secret embedded in the source code can be recovered from the repository or from the compiled binary, allowing an attacker to forge tokens that the application accepts as valid. It also cannot be rotated without shipping a new build.

Detection Strategy

• Analyzes only files that import the jsonwebtoken library

• Looks for calls to the EncodingKey and DecodingKey constructors from_secret, from_base64_secret and from_urlsafe_base64_secret

• Resolves the secret argument back to its definition, looking through the as_ref() and as_bytes() conversions commonly used to turn a string into key material

• Reports a vulnerability when that secret resolves to a non-empty string literal written in the source, either passed inline or stored in a local variable first

• Does not report when the secret comes from an environment variable, a function parameter, or any other value that cannot be resolved to a literal at the call site

• Does not report constructors with the same method name on unrelated types, since the receiver must be EncodingKey or DecodingKey

Vulnerable code example

use jsonwebtoken::EncodingKey;

fn signing_key() -> EncodingKey {
    // VULNERABLE: the signing secret ships with the source, so anyone who reads
    // the repository or the binary can forge tokens the app will accept
    EncodingKey::from_secret(b"super-secret-key")
}

✅ Secure code example

use jsonwebtoken::EncodingKey;
use std::env;

fn signing_key() -> EncodingKey {
    // SAFE: the secret is supplied at runtime, so it never reaches the
    // repository and can be rotated without a new build
    let secret = env::var("JWT_SECRET").unwrap_or_default();
    EncodingKey::from_secret(secret.as_bytes())...