Skip to content

sec(auth): security enhancement & key management

Faiz requested to merge fix/jwt-signing-key-from-env into master

sec(auth): JWT security enhancement & key management

  • Enforce min 32-byte JWT_SIGNING_KEY in InitRequestUtils.
  • Stop service startup on InitCoreModule errors.
  • Enforce Bearer, exp, iss, sessionId, and HS256 in CheckToken.
  • Add CheckTokenWithoutSession for session-less flows.
  • Add SignClaims helper and JWT regression tests.
Edited by Faiz

Merge request reports