fixed jwtSecret issue

reinvent-fiuba · Jul 7, 2024 · 4372d83 · 4372d83
1 parent 70d8627
commit 4372d83
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 17 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -28,7 +28,7 @@ WORKDIR /app
 COPY --from=build /home/gradle/project/build/libs/*.jar app.jar
 
 # Set environment variables with default values
-ENV SPRING_PROFILES_ACTIVE=default
+ENV SPRING_PROFILES_ACTIVE=local,producer,development
 ENV QUEUE_SERVICE_HOST=localhost
 
 # Expose the port the app runs on

diff --git a/src/main/java/com/example/rpl/RPL/security/JwtTokenProvider.java b/src/main/java/com/example/rpl/RPL/security/JwtTokenProvider.java
@@ -24,32 +24,30 @@ public class JwtTokenProvider {
     @Value("${app.jwtExpirationInMs}")
     private int jwtExpirationInMs;
 
-    public String generateToken(Authentication authentication) {
+    public String generateToken(Authentication authentication) throws io.jsonwebtoken.security.WeakKeyException {
+
+        String secretKey = jwtSecret;
+
+        if (secretKey.length() < 256 / 8) {
+            throw new io.jsonwebtoken.security.WeakKeyException("Can't use 'jwtSecret' shorteer than 256 bits");
+        } else if (secretKey.length() >= (256 / 8) && secretKey.length() < (512 / 8)) {
+            secretKey = secretKey + secretKey;
+        }
 
         UserPrincipal userPrincipal = (UserPrincipal) authentication.getPrincipal();
 
         Date now = new Date();
         Date expiryDate = new Date(now.getTime() + jwtExpirationInMs);
 
-        Key signingKey = new SecretKeySpec(jwtSecret.getBytes(),
-                SignatureAlgorithm.HS512.getJcaName());
+        Key signingKey = new SecretKeySpec(secretKey.getBytes(), SignatureAlgorithm.HS512.getJcaName());
 
-        return Jwts.builder()
-                .setSubject(Long.toString(userPrincipal.getId()))
-                .setIssuedAt(new Date())
-                .setExpiration(expiryDate)
-                .signWith(signingKey)
-                .compact();
+        return Jwts.builder().setSubject(Long.toString(userPrincipal.getId())).setIssuedAt(new Date())
+                .setExpiration(expiryDate).signWith(signingKey).compact();
     }
 
     public Long getUserIdFromJWT(String token) {
-        Key signingKey = new SecretKeySpec(jwtSecret.getBytes(),
-                SignatureAlgorithm.HS512.getJcaName());
-        Claims claims = Jwts.parserBuilder()
-                .setSigningKey(signingKey)
-                .build()
-                .parseClaimsJws(token)
-                .getBody();
+        Key signingKey = new SecretKeySpec(jwtSecret.getBytes(), SignatureAlgorithm.HS512.getJcaName());
+        Claims claims = Jwts.parserBuilder().setSigningKey(signingKey).build().parseClaimsJws(token).getBody();
 
         return Long.parseLong(claims.getSubject());
     }