Description

This vulnerability detector identifies hardcoded JWT secret keys in Elixir applications. When JWT tokens are signed with hardcoded secrets in the source code, attackers can forge authentication tokens and bypass security controls, leading to unauthorized access to protected resources.

Detection Strategy

• Scans for function calls to JWT signing methods (Guardian.encode_and_sign and Joken.generate_and_sign)

• Checks if these functions are called with a hardcoded secret key as the second argument

• Reports a vulnerability when a JWT signing function uses a literal string, number, or other hardcoded value as the secret key instead of retrieving it from environment variables or secure configuration

Vulnerable code example

defmodule JwtVulnerable do
  alias Joken.Signer

  def create_token do
    Joken.Signer.create("HS256", "hardcoded-secret")  # Vulnerable: hardcoded JWT secret
  end

  def create_with_variable do...

✅ Secure code example

defmodule JwtSecure do
  alias Joken.Signer

  def create_token do
    secret = System.get_env("JWT_SECRET")  # Safe: secret from environment variable
    Joken.Signer.create("HS256", secret)
  end
...