[Security][Critical] Default JWT secret allows token forgery when JWT_SECRET env var is unset #707

Summary

backend/app/config.py falls back to a hardcoded well-known string when JWT_SECRET is not set. Any attacker who knows this default can forge valid JWT tokens for any user_id.

Affected File

backend/app/config.py (or backend/app/settings.py)

jwt_secret = os.getenv("JWT_SECRET", "change-this-in-production-min-32-bytes")

Impact

With the known default, an attacker can call jwt.encode({"user_id": <any_id>}, "change-this-in-production-min-32-bytes", algorithm="HS256") and gain authenticated access to all endpoints in history.py, user_data.py, and chat.py.

Suggested Fix

Remove the default entirely. Raise a startup error if JWT_SECRET is not set:

jwt_secret = os.environ["JWT_SECRET"]  # KeyError at startup if missing

Severity

Critical