Skip to content

Fix JWT secret validation and deployment guidance #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
osama1998H merged 2 commits into from
Mar 28, 2026
Merged

Fix JWT secret validation and deployment guidance #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c52b89
Update Go and migrate versions for local and CI setup
osama1998H Mar 28, 2026
2faba35
Fix flaky JWT tampering test
osama1998H Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,4 +36,4 @@ SMTP_PASSWORD=
SMTP_FROM=noreply@example.com

# URL used in email links (e.g., password reset links)
APP_BASE_URL=http://localhost:3000
APP_BASE_URL=http://localhost:8080
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:

- name: Install migrate
run: |
curl -L https://github.com/golang-migrate/migrate/releases/download/v4.17.0/migrate.linux-amd64.tar.gz | tar xvz
curl -L https://github.com/golang-migrate/migrate/releases/download/v4.19.1/migrate.linux-amd64.tar.gz | tar xvz
sudo mv migrate /usr/local/bin/
Comment on lines +49 to 50

@coderabbitai coderabbitai Bot Mar 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

❓ Verification inconclusive

Script executed:

#!/bin/bash
# Verify release assets available for the pinned tag
set -euo pipefail
gh api repos/golang-migrate/migrate/releases/tags/v4.19.1 --jq '.assets[].name'

Repository: osama1998H/uniauth

Repository: osama1998H/uniauth
Exit code: 1

stdout:

{
  "message": "Bad credentials",
  "documentation_url": "https://docs.github.com/rest",
  "status": "401"
}

stderr:

gh: Bad credentials (HTTP 401)

Script executed:

# Check migrate v4.19.1 release assets via GitHub API
curl -s "https://api.github.com/repos/golang-migrate/migrate/releases/tags/v4.19.1" | jq -r '.assets[] | .name' 2>/dev/null | head -20

Repository: osama1998H/uniauth

Repository: osama1998H/uniauth
Exit code: 0

stdout:

migrate-4.19.1.zip
migrate.darwin-amd64.tar.gz
migrate.darwin-arm64.tar.gz
migrate.linux-386.deb
migrate.linux-386.tar.gz
migrate.linux-amd64.deb
migrate.linux-amd64.tar.gz
migrate.linux-arm64.deb
migrate.linux-arm64.tar.gz
migrate.linux-armv7.deb
migrate.linux-armv7.tar.gz
migrate.windows-386.zip
migrate.windows-amd64.zip
migrate.windows-arm64.zip
migrate.windows-armv7.zip
sha256sum.txt

Script executed:

# Also inspect the actual workflow file to see full context around lines 49-50
cat -n .github/workflows/ci.yml | sed -n '40,60p'

Repository: osama1998H/uniauth

Repository: osama1998H/uniauth
Exit code: 0

stdout:

    40	      - uses: actions/checkout@v4
    41	
    42	      - uses: actions/setup-go@v5
    43	        with:
    44	          go-version-file: go.mod
    45	          cache: true
    46	
    47	      - name: Install migrate
    48	        run: |
    49	          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.19.1/migrate.linux-amd64.tar.gz | tar xvz
    50	          sudo mv migrate /usr/local/bin/
    51	
    52	      - name: Run migrations
    53	        run: migrate -path migrations -database "postgres://uniauth:uniauth@localhost:5432/uniauth_test?sslmode=disable" up
    54	
    55	      - name: Run tests
    56	        env:
    57	          DATABASE_URL: postgres://uniauth:uniauth@localhost:5432/uniauth_test?sslmode=disable
    58	          REDIS_URL: redis://localhost:6379/0
    59	          JWT_SECRET: test-secret-key-for-ci-32-charsx
    60	        run: go test ./... -race -timeout 120s

Fix checksum verification for migrate binary download.

The workflow downloads the migrate binary without integrity verification, which creates a supply-chain risk. The GitHub release provides a sha256sum.txt file for verification.

🔐 Suggested hardening patch 
-          curl -L https://github.com/golang-migrate/migrate/releases/download/v4.19.1/migrate.linux-amd64.tar.gz | tar xvz
-          sudo mv migrate /usr/local/bin/
+          MIGRATE_VERSION=v4.19.1
+          ARCHIVE=migrate.linux-amd64.tar.gz
+          curl -fsSLo "$ARCHIVE" "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/${ARCHIVE}"
+          curl -fsSLo sha256sum.txt "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/sha256sum.txt"
+          grep " ${ARCHIVE}$" sha256sum.txt | sha256sum -c -
+          tar -xzf "$ARCHIVE" migrate
+          sudo install -m 0755 migrate /usr/local/bin/migrate
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
curl -L https://github.com/golang-migrate/migrate/releases/download/v4.19.1/migrate.linux-amd64.tar.gz | tar xvz
sudo mv migrate /usr/local/bin/
MIGRATE_VERSION=v4.19.1
ARCHIVE=migrate.linux-amd64.tar.gz
curl -fsSLo "$ARCHIVE" "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/${ARCHIVE}"
curl -fsSLo sha256sum.txt "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/sha256sum.txt"
grep " ${ARCHIVE}$" sha256sum.txt | sha256sum -c -
tar -xzf "$ARCHIVE" migrate
sudo install -m 0755 migrate /usr/local/bin/migrate
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 49 - 50, The workflow currently
downloads and moves the migrate binary without verifying integrity; update the
CI steps that call curl and sudo mv (the lines downloading
migrate.linux-amd64.tar.gz and moving migrate) to also download the
corresponding sha256sum.txt from the same GitHub release, verify the tarball
with sha256sum -c (or an equivalent sha256 check) before extracting, and only
proceed to tar xvz and sudo mv migrate /usr/local/bin/ if the checksum
verification succeeds; ensure you reference the release's sha256sum.txt and the
archive name migrate.linux-amd64.tar.gz when adding the verification step.


- name: Run migrations
Expand All @@ -56,7 +56,7 @@ jobs:
env:
DATABASE_URL: postgres://uniauth:uniauth@localhost:5432/uniauth_test?sslmode=disable
REDIS_URL: redis://localhost:6379/0
JWT_SECRET: test-secret-key-for-ci
JWT_SECRET: test-secret-key-for-ci-32-charsx
run: go test ./... -race -timeout 120s

lint:
Expand Down
4 changes: 2 additions & 2 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Thank you for your interest in contributing! This document explains how to get s

### Prerequisites

- Go 1.24+
- Go 1.24.7+
- Docker & Docker Compose
- `make`

Expand Down Expand Up @@ -100,7 +100,7 @@ func TestListSessions(t *testing.T) { ... }
## Running Tests

```bash
# Unit + integration tests (requires Docker for testcontainers)
# Unit + integration tests
make test

# Short tests only (no DB)
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ─── Build stage ─────────────────────────────────────────────────────────────
FROM golang:1.24-alpine AS builder
FROM golang:1.24.7-alpine AS builder

RUN apk add --no-cache git ca-certificates

Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ docker-down:
# ─── Dev setup ───────────────────────────────────────────────────────────────

setup: ## Install development tools
go install github.com/golang-migrate/migrate/v4/cmd/migrate@latest
go install github.com/golang-migrate/migrate/v4/cmd/migrate@v4.19.1
go install golang.org/x/tools/cmd/goimports@latest
go install github.com/swaggo/swag/cmd/swag@latest

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@ docker run -d \

| Layer | Technology |
|---|---|
| Language | Go 1.24 |
| Language | Go 1.24.7 |
| HTTP Router | [chi](https://github.com/go-chi/chi) |
| Database | PostgreSQL 16 (pgx/v5) |
| Cache | Redis 7 |
Expand Down
19 changes: 15 additions & 4 deletions pkg/token/jwt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,12 +242,23 @@ func TestMaker_VerifyAccessToken_TamperedToken(t *testing.T) {
orgID := uuid.New()

tokenStr, _, _ := maker.CreateAccessToken(userID, orgID)
// Flip the last character to tamper with the signature
tampered := tokenStr[:len(tokenStr)-1] + "X"
if tampered[len(tampered)-1] == tokenStr[len(tokenStr)-1] {
tampered = tokenStr[:len(tokenStr)-1] + "Y"
parts := strings.Split(tokenStr, ".")
if len(parts) != 3 {
t.Fatalf("expected JWT with 3 segments, got %d", len(parts))
}

signature := parts[2]
if signature == "" {
t.Fatal("expected non-empty JWT signature")
}

// Mutate the first signature character so the decoded signature bytes always change.
tamperedSignature := "A" + signature[1:]
if tamperedSignature[0] == signature[0] {
tamperedSignature = "B" + signature[1:]
}
tampered := strings.Join([]string{parts[0], parts[1], tamperedSignature}, ".")

_, err := maker.VerifyAccessToken(tampered)
if err == nil {
t.Fatal("expected error for tampered token, got nil")
Expand Down
Loading