From 1626397d57dcde192d201d27085d3de75f894bc6 Mon Sep 17 00:00:00 2001
From: saaa99999999 <yangjia3250749707@outlook.com>
Date: Tue, 26 May 2026 20:57:14 +0800
Subject: [PATCH] Security: Fix hardcoded credentials and sensitive data
 exposure

Remove hardcoded JWT signing key defaults, default admin password,
database credentials, prometheus basic auth, and JWT token logging.

CWE-798: Hardcoded JWT keys and credentials in config defaults
CWE-532: JWT access token logged in plaintext
---
 .devcontainer/.env                  | 4 ++--
 configs/dev/middleware.toml         | 2 +-
 internal/config/config.go           | 6 +++---
 internal/config/middleware.go       | 2 +-
 internal/mods/rbac/biz/login.biz.go | 2 +-
 internal/wirex/injector.go          | 4 ++++
 pkg/jwtx/jwt.go                     | 4 ++--
 7 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/.devcontainer/.env b/.devcontainer/.env
index cdbe3af2..fc4e2f37 100644
--- a/.devcontainer/.env
+++ b/.devcontainer/.env
@@ -1,5 +1,5 @@
 
 POSTGRES_DB=ginadmin
 POSTGRES_USER=postgres
-POSTGRES_PASSWORD=123456
-DATABASE_URL=postgres://postgres:123456@db:5432/ginadmin
+POSTGRES_PASSWORD=change_me
+DATABASE_URL=postgres://postgres:change_me@db:5432/ginadmin
diff --git a/configs/dev/middleware.toml b/configs/dev/middleware.toml
index 1f290996..305cf508 100644
--- a/configs/dev/middleware.toml
+++ b/configs/dev/middleware.toml
@@ -28,7 +28,7 @@ MaxContentLen = 134217728 # 128MB
 Disable = false
 SkippedPathPrefixes = ["/api/v1/captcha/", "/api/v1/login"]
 SigningMethod = "HS512" # HS256/HS384/HS512
-SigningKey = "XnEsT0S@" # Secret key
+SigningKey = "" # CHANGE_ME: generate a secure random key # Secret key
 OldSigningKey = "" # Old secret key (For change secret key)
 Expired = 86400 # seconds
 
diff --git a/internal/config/config.go b/internal/config/config.go
index 2f763af9..f17217b5 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -23,7 +23,7 @@ type General struct {
 	PprofAddr          string
 	DisableSwagger     bool
 	DisablePrintConfig bool
-	DefaultLoginPwd    string `default:"6351623c8cef86fefabfa7da046fc619"` // MD5(abc-123)
+	DefaultLoginPwd    string `default:""` // change default password
 	WorkDir            string // From command arguments
 	MenuFile           string // From schema.Menus (JSON/YAML)
 	DenyOperateMenu    bool
@@ -98,8 +98,8 @@ type Util struct {
 	Prometheus struct {
 		Enable         bool
 		Port           int    `default:"9100"`
-		BasicUsername  string `default:"admin"`
-		BasicPassword  string `default:"admin"`
+		BasicUsername  string `default:""`
+		BasicPassword  string `default:""`
 		LogApis        []string
 		LogMethods     []string
 		DefaultCollect bool
diff --git a/internal/config/middleware.go b/internal/config/middleware.go
index 6bdcb47d..73a1396b 100644
--- a/internal/config/middleware.go
+++ b/internal/config/middleware.go
@@ -36,7 +36,7 @@ type Middleware struct {
 		Disable             bool
 		SkippedPathPrefixes []string
 		SigningMethod       string `default:"HS512"`    // HS256/HS384/HS512
-		SigningKey          string `default:"XnEsT0S@"` // secret key
+		SigningKey          string `default:""` // change to a secure random key
 		OldSigningKey       string // old secret key (for migration)
 		Expired             int    `default:"86400"` // seconds
 		Store               struct {
diff --git a/internal/mods/rbac/biz/login.biz.go b/internal/mods/rbac/biz/login.biz.go
index 8c6857ea..6af8cba1 100644
--- a/internal/mods/rbac/biz/login.biz.go
+++ b/internal/mods/rbac/biz/login.biz.go
@@ -131,7 +131,7 @@ func (a *Login) genUserToken(ctx context.Context, userID string) (*schema.LoginT
 	if err != nil {
 		return nil, err
 	}
-	logging.Context(ctx).Info("Generate user token", zap.Any("token", string(tokenBuf)))
+	logging.Context(ctx).Info("Generate user token")
 
 	return &schema.LoginToken{
 		AccessToken: token.GetAccessToken(),
diff --git a/internal/wirex/injector.go b/internal/wirex/injector.go
index d5db189d..094b8642 100644
--- a/internal/wirex/injector.go
+++ b/internal/wirex/injector.go
@@ -1,6 +1,7 @@
 package wirex
 
 import (
+	"fmt"
 	"context"
 	"time"
 
@@ -87,6 +88,9 @@ func InitCacher(ctx context.Context) (cachex.Cacher, func(), error) {
 }
 
 func InitAuth(ctx context.Context) (jwtx.Auther, func(), error) {
+	if config.C.Middleware.Auth.SigningKey == "" {
+		return nil, nil, fmt.Errorf("middleware.auth.signingKey is required, please set a secure random key")
+	}
 	cfg := config.C.Middleware.Auth
 	var opts []jwtx.Option
 	opts = append(opts, jwtx.SetExpired(cfg.Expired))
diff --git a/pkg/jwtx/jwt.go b/pkg/jwtx/jwt.go
index 72cb5fe3..38b01551 100644
--- a/pkg/jwtx/jwt.go
+++ b/pkg/jwtx/jwt.go
@@ -19,7 +19,7 @@ type Auther interface {
 	Release(ctx context.Context) error
 }
 
-const defaultKey = "CG24SDVP8OHPK395GB5G"
+
 
 var ErrInvalidToken = errors.New("Invalid token")
 
@@ -60,7 +60,7 @@ func New(store Storer, opts ...Option) Auther {
 		tokenType:     "Bearer",
 		expired:       7200,
 		signingMethod: jwt.SigningMethodHS512,
-		signingKey:    []byte(defaultKey),
+		signingKey:    []byte{},
 	}
 
 	for _, opt := range opts {