Repository navigation
JWT secret not rotated / no key rollover mechanism #489
Description
What
The application has no mechanism to rotate the JWT signing key without invalidating all existing tokens.
Why
If the JWT secret is compromised (leaked, exposed in logs, etc.), there is no way to:
- Issue new tokens with a new key while allowing old tokens to expire naturally
- Support multiple active signing keys during a rotation window
- Gracefully transition between keys
This means a key compromise requires either:
- Immediate invalidation of ALL user sessions (bad UX)
- Continuing to use a compromised key (security risk)
Scope
- Support an array of JWT secrets (current + previous)
- Verify tokens against all active secrets
- Sign new tokens only with the latest secret
- Add a configuration option for key rotation (JWT_SECRET_PREVIOUS)
- Document the rotation procedure
Acceptance Criteria
- Multiple JWT secrets can be configured
- Token verification checks all configured secrets
- New tokens are signed with the latest secret
- Graceful transition when adding a new key
Technical Context
- File: src/server.ts:184-187 (JWT registration)
- Fastify JWT supports verify with multiple secrets via an array
- Config: JWT_SECRET (current), JWT_SECRET_PREVIOUS (optional)
Activity
BIGdigii commentedon Sep 30, 2026
@BIGdigii has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @BIGdigii to this issue.
Johnsource-hub commentedon Sep 30, 2026
@Johnsource-hub has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Johnsource-hub to this issue.
Mike008-Div commentedon Sep 30, 2026
@Mike008-Div has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mike008-Div to this issue.
oomokaro1 commentedon Sep 30, 2026
@oomokaro1 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @oomokaro1 to this issue.
toyosi-14 commentedon Sep 30, 2026
@toyosi-14 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @toyosi-14 to this issue.
Uhiara commentedon Sep 30, 2026
@Uhiara has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Uhiara to this issue.
drips-wave commentedon Sep 30, 2026
Congratulations, @oomokaro1! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @oomokaro1: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
feat: support JWT signing key rotation via JWT_SECRET_PREVIOUS (#489)
grantfox-oss commentedon Oct 1, 2026
🎉 This issue has been marked as completed on GrantFox!
@oomokaro1's PR #543 was approved and merged by @DeFiVC.
🏆 @oomokaro1: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (952 total points). Track your full progress on GrantFox.
👏 Great work, @oomokaro1! Keep contributing to ChainLearnOfficial.