From 34b85b5e9ff01d3a891adaeed525e76079313954 Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Thu, 17 Jan 2019 23:28:16 +0000 Subject: [PATCH] --- devdocs/todo.txt | 8 -------- 1 file changed, 8 deletions(-) diff --git a/devdocs/todo.txt b/devdocs/todo.txt index 00672110..1b769663 100644 --- a/devdocs/todo.txt +++ b/devdocs/todo.txt @@ -25,14 +25,6 @@ SERVER https://news.ycombinator.com/item?id=14292223 https://news.ycombinator.com/item?id=18804875 - - JWT Secret key issue: - - Secret key based on license to but is read in before license is read so it's always actually "UNLICENSED" as the regto making the jwt secret the same for all installations - - Unless overridden which no one will do - - Need to randomly generate a secret key on installation and add it as an environment variable - - Don't allow boot without pre-set secret key - - Un-tie secret key from license, they are two different things entirely and shouldn't be confounded - - - Add tests to ensure security of JWT - https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_security_cheatsheet.pdf