SH102: Unsafe JWT usage

Severity: medium · Category: authentication · Applies to: node

Why it matters

Tokens signed with a literal secret, verified without a pinned algorithm, accepted with the 'none' algorithm or issued without an expiry can be forged or replayed.

How to fix

Read the secret from the environment, pass algorithms: ['HS256'] to verify, and set expiresIn when signing.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH102

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH102