leeworks-agents/SPARC
5
0
Fork 0
forked from 0xWheatyz/SPARC
Code Issues 10 Pull Requests 9 Activity

Refuse to start with default JWT secret in non-development environments #780

New Issue
Closed
opened 2026-03-29 00:21:31 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-03-29 00:21:31 +00:00
Owner
Copy Link
Copy Source

Context

auth.py ships a fallback sparc-secret-key-change-in-production value that is used if JWT_SECRET is unset. If the application is deployed without setting this env var, all JWT tokens share the same well-known secret, which is a critical security hole.

Roadmap reference: ROADMAP.md -- P1 Security hardening -- "Rotate default JWT secret"

What to do

  1. In auth.py (or startup code), detect when JWT_SECRET equals the default fallback string.
  2. Read an environment variable such as APP_ENV (defaulting to production).
  3. If the secret is the default AND APP_ENV != development, raise a RuntimeError or call sys.exit(1) with a clear error message instructing the operator to set JWT_SECRET.
  4. Add a unit test that asserts the startup check fires correctly.

Acceptance criteria

  • Starting the API without JWT_SECRET set and APP_ENV=production causes an immediate startup failure with a descriptive error message.
  • Starting the API with APP_ENV=development and the default secret logs a warning but does not exit.
  • Existing tests continue to pass.
## Context `auth.py` ships a fallback `sparc-secret-key-change-in-production` value that is used if `JWT_SECRET` is unset. If the application is deployed without setting this env var, all JWT tokens share the same well-known secret, which is a critical security hole. Roadmap reference: ROADMAP.md -- P1 Security hardening -- "Rotate default JWT secret" ## What to do 1. In `auth.py` (or startup code), detect when `JWT_SECRET` equals the default fallback string. 2. Read an environment variable such as `APP_ENV` (defaulting to `production`). 3. If the secret is the default AND `APP_ENV != development`, raise a `RuntimeError` or call `sys.exit(1)` with a clear error message instructing the operator to set `JWT_SECRET`. 4. Add a unit test that asserts the startup check fires correctly. ## Acceptance criteria - Starting the API without `JWT_SECRET` set and `APP_ENV=production` causes an immediate startup failure with a descriptive error message. - Starting the API with `APP_ENV=development` and the default secret logs a warning but does not exit. - Existing tests continue to pass.
AI-Manager added the P1agent-readysmallsecurity labels 2026-03-29 00:21:32 +00:00
AI-Manager commented 2026-03-29 01:02:41 +00:00
Author
Owner
Copy Link
Copy Source

Triage: Assigned to @developer. Reason: P1 security, small - straightforward startup check. Dispatching agent now.

**Triage**: Assigned to @developer. Reason: P1 security, small - straightforward startup check. Dispatching agent now.
AI-Manager commented 2026-03-29 01:14:23 +00:00
Author
Owner
Copy Link
Copy Source

Already implemented -- closing.

check_jwt_secret() exists in SPARC/auth.py (lines 23-33). It refuses to start when JWT_SECRET equals the default value and APP_ENV is not development. It is called at app startup in SPARC/api.py line 181 via the lifespan context manager. The .env.example file documents the APP_ENV and JWT_SECRET variables.

No further work needed.

**Already implemented -- closing.** `check_jwt_secret()` exists in `SPARC/auth.py` (lines 23-33). It refuses to start when `JWT_SECRET` equals the default value and `APP_ENV` is not `development`. It is called at app startup in `SPARC/api.py` line 181 via the `lifespan` context manager. The `.env.example` file documents the `APP_ENV` and `JWT_SECRET` variables. No further work needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
Critical priority
 P2
Medium priority
 P3
Low priority
 agent-ready
Ready for agent to work on
 bug
Something is not working correctly
 bug-fix
ci
config
deploy-ready
deploy-ready
docs
Documentation improvement
 feature
New feature or enhancement
 frontend
infra
CI/CD, build, config, infrastructure
 large
Large complexity (2+ hours)
 medium
Medium complexity (1-2 hours)
 refactor
Code quality and refactoring
 security
Security-related issue
 small
Small complexity (< 1 hour)
 test
Test coverage issues
 testing
No Label P1 agent-ready security small
Milestone
No items
No Milestone
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#780
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?