Fix security issue: Hard-coded JWT Secret Key in Authentication Backend (CWE-798)

2025-06-09 16:52:29 +00:00
1 changed files with 6 additions and 2 deletions
--- a/cognee/modules/users/authentication/get_auth_backend.py
+++ b/cognee/modules/users/authentication/get_auth_backend.py
@ -29,7 +29,11 @@ def get_auth_backend():
    bearer_transport = BearerTransport(tokenUrl="api/v1/auth/login")

    def get_jwt_strategy() -> JWTStrategy[models.UP, models.ID]:
-        secret = os.getenv("FASTAPI_USERS_JWT_SECRET", "super_secret")
+        secret = os.getenv("FASTAPI_USERS_JWT_SECRET")
+        if not secret:
+            raise RuntimeError(
+                "FASTAPI_USERS_JWT_SECRET environment variable must be set and non-empty for JWT authentication."
+            )
        return CustomJWTStrategy(secret, lifetime_seconds=3600)

    auth_backend = AuthenticationBackend(
@ -38,4 +42,4 @@ def get_auth_backend():
        get_strategy=get_jwt_strategy,
    )

-    return auth_backend
+    return auth_backend