diff --git a/Readme.md b/Readme.md
index 89d9f2d9d..709604010 100644
--- a/Readme.md
+++ b/Readme.md
@@ -71,9 +71,9 @@ http://localhost:8080/example/editor?fileExt=docx&userid=uid-1&lang=en&directUrl
docker compose down
```
-> **Security note:** The compose file sets `JWT_SECRET=secret`. This is
-> intentionally insecure and is only suitable for local development and
-> testing. Never expose this setup to a public network.
+> **Security note:** The compose file sets a default `JWT_SECRET` for local development only.
+> Never expose this setup to a public network and always replace the secret with a strong,
+> unique value in any non-development environment.
## API methods for test examples
diff --git a/docker-compose.yml b/docker-compose.yml
index b98f526d3..5b830b7fb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -45,7 +45,7 @@ services:
image: ghcr.io/euro-office/documentserver:latest
environment:
EXAMPLE_ENABLED: "true"
- JWT_SECRET: "secret"
+ JWT_SECRET: "euro-office-dev-jwt-secret-key-2026"
container_name: eo-documentserver
ports:
- "8080:80"
\ No newline at end of file
diff --git a/web/documentserver-example/csharp-mvc/README.md b/web/documentserver-example/csharp-mvc/README.md
index 93c4eda0f..102dadec5 100644
--- a/web/documentserver-example/csharp-mvc/README.md
+++ b/web/documentserver-example/csharp-mvc/README.md
@@ -43,7 +43,7 @@ Configure the IIS components for the server to work correctly:
Open the *web.appsettings.config* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
-
+
```
## Step 5. Run your website with the editors
diff --git a/web/documentserver-example/csharp/README.md b/web/documentserver-example/csharp/README.md
index db7617b1f..82a2d92d9 100644
--- a/web/documentserver-example/csharp/README.md
+++ b/web/documentserver-example/csharp/README.md
@@ -44,7 +44,7 @@ Configure the IIS components for the server to work correctly:
Open the *settings.config* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
-
+
```
## Step 5. Run your website with the editors
diff --git a/web/documentserver-example/go/README.md b/web/documentserver-example/go/README.md
index d46a73438..101d9222d 100644
--- a/web/documentserver-example/go/README.md
+++ b/web/documentserver-example/go/README.md
@@ -24,7 +24,7 @@ SERVER_PORT=port
DOC_SERVER_HOST=http://documentserver/
JWT_IS_ENABLED=flag
-JWT_SECRET=secret
+JWT_SECRET=euro-office-dev-jwt-secret-key-2026
JWT_HEADER=Authorization
```
@@ -62,7 +62,7 @@ Also, [specify the same secret key](https://helpcenter.onlyoffice.com/installati
```
{
- "JWT_SECRET" : "secret",
+ "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026",
}
```
diff --git a/web/documentserver-example/go/config/configuration.json b/web/documentserver-example/go/config/configuration.json
index 29c913b94..8d20fd33a 100644
--- a/web/documentserver-example/go/config/configuration.json
+++ b/web/documentserver-example/go/config/configuration.json
@@ -12,7 +12,7 @@
"JWT_IS_ENABLED" : false,
"JWT_EXPIRES_IN" : 5,
- "JWT_SECRET" : "secret",
+ "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026",
"JWT_HEADER" : "Authorization",
"STORAGE_PATH" : "filestore",
diff --git a/web/documentserver-example/java-spring/README.md b/web/documentserver-example/java-spring/README.md
index f5dd60703..f8925f9d9 100755
--- a/web/documentserver-example/java-spring/README.md
+++ b/web/documentserver-example/java-spring/README.md
@@ -99,7 +99,7 @@ To run the Java example code, install the Java version 11 appropriate for your O
Open the *src/main/resouces/application.properties* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
-docservice.security.key=secret
+docservice.security.key=euro-office-dev-jwt-secret-key-2026
```
### Step 6. Start application with Maven
@@ -184,7 +184,7 @@ See the detailed guide to learn how to install Document Server [for Linux](https
[Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
- docservice.security.key=secret
+ docservice.security.key=euro-office-dev-jwt-secret-key-2026
```
5. Install **Maven**:
@@ -275,7 +275,7 @@ See the detailed guide to learn how to install Document Server [for Docker](http
[Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
- docservice.security.key=secret
+ docservice.security.key=euro-office-dev-jwt-secret-key-2026
```
6. Run the next command in the java example directory:
diff --git a/web/documentserver-example/java/README.md b/web/documentserver-example/java/README.md
index 277544da8..82a5b4dd9 100644
--- a/web/documentserver-example/java/README.md
+++ b/web/documentserver-example/java/README.md
@@ -93,7 +93,7 @@ To run the Java example code, install the Java version appropriate for your OS a
Open the *src/main/resouces/settings.properties* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
-files.docservice.secret=secret
+files.docservice.secret=euro-office-dev-jwt-secret-key-2026
```
### Step 6. Run the Java code
@@ -187,7 +187,7 @@ See the detailed guide to learn how to [install Document Server for Linux](https
[Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
- files.docservice.secret=secret
+ files.docservice.secret=euro-office-dev-jwt-secret-key-2026
```
5. Install **Maven**:
@@ -295,7 +295,7 @@ See the detailed guide to learn how to install Document Server [for Docker](http
[Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT:
```
- files.docservice.secret=secret
+ files.docservice.secret=euro-office-dev-jwt-secret-key-2026
```
6. Run the next command in the Java example directory:
diff --git a/web/documentserver-example/nodejs/README.md b/web/documentserver-example/nodejs/README.md
index a76934355..f8a84e049 100644
--- a/web/documentserver-example/nodejs/README.md
+++ b/web/documentserver-example/nodejs/README.md
@@ -52,7 +52,7 @@ Also, [specify the same secret key](https://helpcenter.onlyoffice.com/installati
{
"server": {
"token": {
- "secret": "secret"
+ "secret": "euro-office-dev-jwt-secret-key-2026"
}
}
}
@@ -173,7 +173,7 @@ See the detailed guide to learn how to [install Document Server for Linux](https
{
"server": {
"token": {
- "secret": "secret"
+ "secret": "euro-office-dev-jwt-secret-key-2026"
}
}
}
diff --git a/web/documentserver-example/nodejs/config/default.json b/web/documentserver-example/nodejs/config/default.json
index f8a69cc8a..c192fa22b 100644
--- a/web/documentserver-example/nodejs/config/default.json
+++ b/web/documentserver-example/nodejs/config/default.json
@@ -34,7 +34,7 @@
"algorithmRequest": "HS256",
"authorizationHeader": "Authorization",
"authorizationHeaderPrefix": "Bearer ",
- "secret": "secret",
+ "secret": "euro-office-dev-jwt-secret-key-2026",
"expiresIn": "5m"
},
"verify_peer_off": true,
diff --git a/web/documentserver-example/nodejs/docker-entrypoint.sh b/web/documentserver-example/nodejs/docker-entrypoint.sh
index 553a37e49..1ecdc3c7e 100755
--- a/web/documentserver-example/nodejs/docker-entrypoint.sh
+++ b/web/documentserver-example/nodejs/docker-entrypoint.sh
@@ -6,7 +6,7 @@ export NODE_CONFIG='{
"exampleUrl": "'${EXAMPLE_URL:-http://localhost/example/}'",
"token": {
"enable": '${JWT_ENABLED:-false}',
- "secret": "'${JWT_SECRET:-secret}'",
+ "secret": "'${JWT_SECRET:-euro-office-dev-jwt-secret-key-2026}'",
"authorizationHeader": "'${JWT_HEADER:-Authorization}'"
}
}
diff --git a/web/documentserver-example/php-laravel/.env.example b/web/documentserver-example/php-laravel/.env.example
index f7f4a6d3d..c1e53d24a 100644
--- a/web/documentserver-example/php-laravel/.env.example
+++ b/web/documentserver-example/php-laravel/.env.example
@@ -29,7 +29,7 @@ DOCUMENT_SERVER_PRELOADER_PATH=web-apps/apps/api/documents/preload.html
DOCUMENT_SERVER_JWT_HEADER=Authorization
DOCUMENT_SERVER_JWT_ALGORITHM=HS256
DOCUMENT_SERVER_JWT_USE_FOR_REQUEST=true
-DOCUMENT_SERVER_JWT_SECRET=secret
+DOCUMENT_SERVER_JWT_SECRET=euro-office-dev-jwt-secret-key-2026
DOCUMENT_SERVER_JWT_EXPIRATION=5
DOCUMENT_SERVER_CONVERSION_TIMEOUT=120000
diff --git a/web/documentserver-example/php-laravel/README.md b/web/documentserver-example/php-laravel/README.md
index e73e2bc51..3f4c0fa85 100644
--- a/web/documentserver-example/php-laravel/README.md
+++ b/web/documentserver-example/php-laravel/README.md
@@ -113,7 +113,7 @@ The following table shows the environment variables that is used to configure th
| `DOCUMENT_STORAGE_PRIVATE_URL`| The URL address used by the Document Server to communicate with the server. | `http://proxy` |
| `DOCUMENT_SERVER_PUBLIC_URL` | The URL address used by the client to communicate with the Document Server. | `http://localhost:8080` |
| `DOCUMENT_SERVER_PRIVATE_URL` | The URL address used by the server to communicate with the Document Server. | `http://proxy:8080` |
-| `DOCUMENT_SERVER_JWT_SECRET` | JWT authorization secret. | `your-256-bit-secret` |
+| `DOCUMENT_SERVER_JWT_SECRET` | JWT authorization secret. | `euro-office-dev-jwt-secret-key-2026` |
## Troubleshooting
diff --git a/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php b/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php
index 69e573ea2..afea9b38b 100644
--- a/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php
+++ b/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php
@@ -35,7 +35,7 @@ public function __construct()
$preloaderUrl = $publicServerUrl.'/'.env('DOCUMENT_SERVER_PRELOADER_PATH', 'web-apps/apps/api/documents/preload.html');
$conversionUrl = $privateServerUrl.'/'.env('DOCUMENT_SERVER_CONVERTER_PATH', 'convert');
$commandUrl = $privateServerUrl.'/'.env('DOCUMENT_SERVER_COMMAND_PATH', 'command');
- $jwtSecret = env('DOCUMENT_SERVER_JWT_SECRET', 'secret');
+ $jwtSecret = env('DOCUMENT_SERVER_JWT_SECRET', '');
$jwtExpiration = env('DOCUMENT_SERVER_JWT_EXPIRATION', 5);
$jwtUseForRequest = env('DOCUMENT_SERVER_JWT_USE_FOR_REQUEST', true);
$publicStorageUrl = rtrim(env('DOCUMENT_STORAGE_PUBLIC_URL', request()->schemeAndHttpHost()), '/');
diff --git a/web/documentserver-example/php/README.md b/web/documentserver-example/php/README.md
index f2df1ccc2..664676421 100644
--- a/web/documentserver-example/php/README.md
+++ b/web/documentserver-example/php/README.md
@@ -73,7 +73,7 @@ The example is configured by changing environment variables.
| `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` |
| `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` |
| `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` |
-| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` |
+| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` |
## Security Info
diff --git a/web/documentserver-example/php/docker-compose.yml b/web/documentserver-example/php/docker-compose.yml
index 448fdfce8..acf105ec5 100644
--- a/web/documentserver-example/php/docker-compose.yml
+++ b/web/documentserver-example/php/docker-compose.yml
@@ -7,7 +7,7 @@ services:
expose:
- "80"
environment:
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
example:
container_name: example
@@ -23,7 +23,7 @@ services:
- DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080
- DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080
- EXAMPLE_URL=http://proxy
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
- PORT=80
proxy:
diff --git a/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php b/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php
index 75a710c0e..000a2d7ee 100644
--- a/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php
+++ b/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php
@@ -46,9 +46,9 @@ public function testAssignsADefaultValue()
public function testAssignsAValueFromTheEnvironment()
{
- putenv('JWT_SECRET=your-256-bit-secret');
+ putenv('JWT_SECRET=euro-office-dev-jwt-secret-key-2026');
$configManager = new ConfigurationManager();
$secret = $configManager->jwtSecret();
- $this->assertEquals('your-256-bit-secret', $secret);
+ $this->assertEquals('euro-office-dev-jwt-secret-key-2026', $secret);
}
}
diff --git a/web/documentserver-example/python/README.md b/web/documentserver-example/python/README.md
index cb7ae8408..38d9dae53 100755
--- a/web/documentserver-example/python/README.md
+++ b/web/documentserver-example/python/README.md
@@ -74,7 +74,7 @@ The example is configured by changing environment variables.
| `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` |
| `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` |
| `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` |
-| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` |
+| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` |
## Security Info
diff --git a/web/documentserver-example/python/compose-base.yml b/web/documentserver-example/python/compose-base.yml
index 71b020009..0ff39ef25 100644
--- a/web/documentserver-example/python/compose-base.yml
+++ b/web/documentserver-example/python/compose-base.yml
@@ -7,7 +7,7 @@ services:
expose:
- "80"
environment:
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
example:
container_name: example
@@ -20,7 +20,7 @@ services:
- DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080
- DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080
- EXAMPLE_URL=http://proxy
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
- PORT=80
proxy:
diff --git a/web/documentserver-example/python/src/configuration/configuration_tests.py b/web/documentserver-example/python/src/configuration/configuration_tests.py
index 6a274bb31..171d68a95 100644
--- a/web/documentserver-example/python/src/configuration/configuration_tests.py
+++ b/web/documentserver-example/python/src/configuration/configuration_tests.py
@@ -203,12 +203,12 @@ def test_assigns_a_default_value(self):
self.assertEqual(secret, '')
@patch.dict(environ, {
- 'JWT_SECRET': 'your-256-bit-secret'
+ 'JWT_SECRET': 'euro-office-dev-jwt-secret-key-2026'
})
def test_assigns_a_value_from_the_environment(self):
config_manager = ConfigurationManager()
secret = config_manager.jwt_secret()
- self.assertEqual(secret, 'your-256-bit-secret')
+ self.assertEqual(secret, 'euro-office-dev-jwt-secret-key-2026')
class ConfigurationManagerJWTHeaderTests(TestCase):
diff --git a/web/documentserver-example/ruby/README.md b/web/documentserver-example/ruby/README.md
index c3fcfcfae..5a9a2af0e 100755
--- a/web/documentserver-example/ruby/README.md
+++ b/web/documentserver-example/ruby/README.md
@@ -72,7 +72,7 @@ The example is configured by changing environment variables.
| `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` |
| `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` |
| `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` |
-| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` |
+| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` |
| `PORT` | The port on which the server should be running. | `80` |
## Security Info
diff --git a/web/documentserver-example/ruby/app/configuration/configuration_tests.rb b/web/documentserver-example/ruby/app/configuration/configuration_tests.rb
index 9260dda85..e2fd67820 100644
--- a/web/documentserver-example/ruby/app/configuration/configuration_tests.rb
+++ b/web/documentserver-example/ruby/app/configuration/configuration_tests.rb
@@ -201,10 +201,10 @@ def test_assigns_a_default_value
end
def test_assigns_a_value_from_the_environment
- ENV['JWT_SECRET'] = 'your-256-bit-secret'
+ ENV['JWT_SECRET'] = 'euro-office-dev-jwt-secret-key-2026'
config_manager = ConfigurationManager.new
secret = config_manager.jwt_secret
- assert_equal(secret, 'your-256-bit-secret')
+ assert_equal(secret, 'euro-office-dev-jwt-secret-key-2026')
end
end
diff --git a/web/documentserver-example/ruby/compose-base.yml b/web/documentserver-example/ruby/compose-base.yml
index 73ba02ba0..3f26191a1 100644
--- a/web/documentserver-example/ruby/compose-base.yml
+++ b/web/documentserver-example/ruby/compose-base.yml
@@ -7,7 +7,7 @@ services:
expose:
- "80"
environment:
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
example:
container_name: example
@@ -21,7 +21,7 @@ services:
- DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080
- DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080
- EXAMPLE_URL=http://proxy
- - JWT_SECRET=your-256-bit-secret
+ - JWT_SECRET=euro-office-dev-jwt-secret-key-2026
- PORT=80
proxy: