fix: remove hardcoded JWT default secret fallback - #10
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
무엇을
UserService·gateway의application.yml에서 JWT 시크릿 기본값 폴백을 제거했습니다.왜
기본 시크릿 문자열이 공개 저장소에 그대로 노출돼 있어,
JWT_SECRET_KEY환경변수 없이 앱이 뜨면 누구나 그 값으로 JWT를 위조할 수 있습니다. 폴백을 없애면 환경변수가 없을 때 기동이 실패(fail-fast)하므로 조용히 취약한 상태로 도는 일이 사라집니다.k8s는 이미
JWT_SECRET_KEY를 Secret으로 주입(k8s/apps/gateway.yaml,userservice.yaml)하므로 운영 배포에는 영향 없습니다.확인 필요
그 기본값이 실제 배포에 한 번이라도 쓰였다면, 새 시크릿으로 로테이트하고 k8s Secret을 갱신해 주세요.
🤖 Generated with Claude Code