Skip to content

Conversation

@fsandel
Copy link
Contributor

@fsandel fsandel commented Aug 29, 2024

Add optional STACKIT service account authentication

@fsandel fsandel requested a review from PatrickKoss August 29, 2024 09:27
}
headers = {"kid": credentials["kid"]}
return jwt.encode(
payload, credentials["privateKey"], algorithm="RS512", headers=headers # nosemgrep "privateKey" is just the key for the dictionary

Check failure

Code scanning / semgrep

Semgrep Finding: python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret

Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)
@PatrickKoss PatrickKoss dismissed slm0n87’s stale review August 29, 2024 14:45

Already resolved

@PatrickKoss PatrickKoss merged commit e5d22f7 into main Aug 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants