I am currently creating a Java Spring application that works with the spring security JWT. Everywhere I look and read about the "secret string", it says should be changed in production. Like this line in my application.properties: security.jwt.secret="this-is-a-512-bit-key-used-for-signing-jwt-tokens-that-should-be-changed-production"

As well as in stackoverflow question that are sort-of related like this one here: How to include jwt secret in application.yaml for Java Spring.

My question is, what should that string become in production? Am I supposed to generate this somewhere in a SecurityConfig class? Or should I generate a 512 bit string and just paste that in the application.properties file?

Thanks in advance.

CodePudding user response：

Secrets should not be added in your regular application.properties file because that would be checked into your version control system. There are various ways to externalize configuration but the easiest is usually to define environment variables.

In your case, you would need an environment variable called SECURITY_JWT_SECRET and Spring Boot will pick this up automatically.

CodePudding user response：

One way to change properties of a spring app is using Spring Cloud Config. Basically your config is in a GitHub repo and as soon as you modify, Spring cloud config server propagates it to other applications referencing it through application.properties.

https://cloud.spring.io/spring-cloud-config/reference/html/

CodePudding user response：

I don't have permission to comment so responding to question.

I will share how it has been done in our application which I think one of the standard way of storing credentials. There may be alternate ways also.

1. Its not ideal to store token or credentials in properties
2. We can externalize the token into Vault or config server
3. when server starts spring application can fetch the properties
4. Access to vault are controlled

As we have different vault servers across environments, we can store and change the token in runtime and refresh the application.

Regarding generating the jwt token, it should have some expiry time and refreshed periodically.