JWT: What's a good secret key, and how to store it in an Node.js/Express app?

node.js security express jwt json-web-token
Sam picture Sam · May 7, 2015 · Viewed 17.9k times · Source

Firstly, what's a good method of generating a secret key? I should punch in a lot of random keys on my keyboard to generate one, but there must be a better solution to this. Explain the way to generate a very good key.

Second, what's a good way to store the key? I could write the key in my applications configuration, but that means that a compromise of the source code will compromise the entire system. What's good means of storing the secret key in a Node.js Express app?

Answer

Andrew Lavers picture Andrew Lavers · May 7, 2015

To generate a secret programatically you could use node's crypto.randomBytes()

var crypto = require('crypto');
var jwt = require('jsonwebtoken');

crypto.randomBytes(256, function(ex, buf) {
  if (ex) throw ex;
  var token = jwt.sign({foo: 'bar'}, buf);
  var decoded = jwt.verify(token, buf);
});

As for storing this, you're absolutely correct, you should definitely not store secrets in your source control. A better way would be to load such sensitive information from environment variables, eg process.env.MY_SECRET.

Another less common pattern I've seen is to load secrets from a file stored separate from your code. You could have your node app look for a JSON file in ~/.myapp/secrets.json for instance.

Related questions

Node.js + Express.js User Permission Security Model

We have an application that has two types of users. Depending on how the user logs in, we want them to have access to different parts of the application. How do we implement a security model for preventing users from …

Read More
Authorization approaches and design patterns for Node.js applications

I am building a multiple page admin interface for an internal enterprise software platform. Think lots of glue logic tying together various APIs, db queries, and shell scripts. We will be using node.js, the express framework (including jade templates), …

Read More
Preventing Brute Force Using Node and Express JS

I'm building a website using Node and Express JS and would like to throttle invalid login attempts. Both to prevent online cracking and to reduce unnecessary database calls. What are some ways in which I can implement this?

Read More