[HIGH] — JWT strategy and WebSocket gateway fall back to insecure hardcoded strings when `JWT_SECRET` is unset, allowing weak-secret boots in any environment

[Alqku]

Severity: High
Type: Security hardening
Scope: Auth, Notifications
Labels: security, refactoring, Official Campaign

Description

Two separate code paths accept a default secret when JWT_SECRET is not present in the environment, instead of failing fast:

• JwtStrategy (src/auth/jwt.strategy.ts, line ~12): secretOrKey: configService.get<string>('JWT_SECRET', 'default-secret').
• NotificationsGateway.handleConnection (src/notifications/notifications.gateway.ts, line ~65): this.configService.get<string>('JWT_SECRET', 'orbitchain-default-secret').

Neither module logs a warning at boot when the fallback is used, and the ConfigModule is not validated at application startup (src/main.ts does not call validate on ConfigService). A misconfigured production deployment can therefore boot against a known constant string that an attacker can forge a token for.

Recommendation

• Remove both default-value fallbacks and throw an Error at module construction if JWT_SECRET is missing or shorter than, e.g., 32 bytes.
• Add a ConfigValidationSchema (e.g., class-validator) on ConfigModule.forRoot({ validate }) that requires JWT_SECRET, STELLAR_RPC_URL, STELLAR_NETWORK_PASSPHRASE, REDIS_URL, DATABASE_URL.
• Centralise JWT verification options in a single @Injectable() provider so the gateway and the HTTP strategy cannot drift apart.

---

[ChukwuemekaP1]

Good day, my name is Paul and I'd love to work on this issue.

This is a real security risk — a fallback secret means a misconfigured deployment can boot silently against a known constant string anyone could forge tokens against.

I'll remove both fallbacks in jwt.strategy.ts and notifications.gateway.ts, throwing an error if JWT_SECRET is missing or under 32 bytes. I'll add a ConfigValidationSchema requiring JWT_SECRET, STELLAR_RPC_URL, STELLAR_NETWORK_PASSPHRASE, REDIS_URL, and DATABASE_URL at startup, and centralize JWT verification into a single provider so the HTTP strategy and WebSocket gateway can't drift apart.

ETA: 24 to 48 hours from assignment. Looking forward to your reply!

[grantfox-oss]

🦊 GrantFox — @ChukwuemekaP1 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #3)
2. Your PR will be reviewed by the OrbitChainLabs maintainers

Good luck! Track your progress on GrantFox.