JWT Strategy Weakened

Why it matters

Expiry is what limits the damage of a stolen token; ignoring it turns a one-hour leak into a permanent one. A secret in the source is in every clone and every build log. A fallback like process.env.JWT_SECRET || 'dev-secret' is the same thing in production if the variable is ever missing.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

import { Strategy, ExtractJwt } from 'passport-jwt';
super({ jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), ignoreExpiration: true, secretOrKey: config.get('JWT_SECRET') });

The smallest fix

// jwt.strategy.ts
super({
  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
  ignoreExpiration: false,
  secretOrKey: config.getOrThrow<string>('JWT_SECRET'),
});

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

// Use ConfigService with validation so the app refuses to start without
// JWT_SECRET, and keep access tokens short-lived with a refresh flow.

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Sign a token with an exp in the past and confirm a 401.
2. Start the app without JWT_SECRET and confirm it fails to boot.

Further reading

• https://cwe.mitre.org/data/definitions/613.html
• https://docs.nestjs.com/security/authentication