Search code examples
javaspringspring-securityjwtapplication.properties

In java spring, how to best "change secret in production"?

I am currently creating a Java Spring application that works with the spring security JWT. Everywhere I look and read about the "secret string", it says should be changed in production. Like this line in my application.properties: security.jwt.secret="this-is-a-512-bit-key-used-for-signing-jwt-tokens-that-should-be-changed-production"

As well as in stackoverflow question that are sort-of related like this one here: How to include jwt secret in application.yaml for Java Spring.

My question is, what should that string become in production? Am I supposed to generate this somewhere in a SecurityConfig class? Or should I generate a 512 bit string and just paste that in the application.properties file?

Thanks in advance.

Solution

  • Secrets should not be added in your regular application.properties file because that would be checked into your version control system. There are various ways to externalize configuration but the easiest is usually to define environment variables.

    In your case, you would need an environment variable called SECURITY_JWT_SECRET and Spring Boot will pick this up automatically.