Description

This detector identifies hardcoded JWT (JSON Web Token) secrets in Dart applications that use the dart_jsonwebtoken package. Hardcoded secrets in source code pose a significant security risk as they can be discovered by anyone with access to the codebase, potentially allowing unauthorized token generation and authentication bypass.

Detection Strategy

• The detector only runs on Dart files that import the 'package:dart_jsonwebtoken' library

• Test files are excluded from analysis to avoid false positives on test data

• The detector examines JWT-related method calls and function invocations that may contain secret parameters

• It specifically looks for string literals or hardcoded values being passed as JWT signing secrets

• A vulnerability is reported when a JWT secret is found to be a literal string value rather than being loaded from environment variables, configuration files, or other secure sources

Vulnerable code example

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';

String signToken() {
  final jwt = JWT({'sub': 'user-1'});
  return jwt.sign(SecretKey('hardcoded_secret')); // Hardcoded secret exposed in source
}

JWT verifyToken(String token) {...

✅ Secure code example

import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';
import 'dart:io';

String signToken() {
  final jwt = JWT({'sub': 'user-1'});
  final secret = Platform.environment['JWT_SECRET'] ?? ''; // Load from environment variable
  if (secret.isEmpty) throw Exception('JWT_SECRET not configured');
  return jwt.sign(SecretKey(secret));...