From f5770c80a6602e6b01d34f79464d98e59fdc5a1c Mon Sep 17 00:00:00 2001 From: Christoph Schaefer Date: Wed, 24 Jun 2026 13:27:31 +0200 Subject: [PATCH 1/2] =?UTF-8?q?chore:=20replace=20short=20JWT=5FSECRET=20e?= =?UTF-8?q?xamples=20with=20=E2=89=A532-char=20value?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The EuroOffice connector v11+ enforces a minimum JWT secret length of 32 characters. All example defaults ("secret", "your-256-bit-secret") were under this limit and would fail immediately at runtime. Replace with "euro-office-dev-jwt-secret-key-2026" (35 chars) in all compose files, entrypoints, .env.example, and READMEs. Update the Readme security note to no longer reference the old short literal. Assisted-by: ClaudeCode:claude-sonnet-4-6 Signed-off-by: Christoph Schaefer --- Readme.md | 6 +++--- docker-compose.yml | 2 +- web/documentserver-example/go/README.md | 4 ++-- web/documentserver-example/go/config/configuration.json | 2 +- web/documentserver-example/nodejs/docker-entrypoint.sh | 2 +- web/documentserver-example/php-laravel/.env.example | 2 +- web/documentserver-example/php/docker-compose.yml | 4 ++-- web/documentserver-example/python/compose-base.yml | 4 ++-- web/documentserver-example/ruby/compose-base.yml | 4 ++-- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Readme.md b/Readme.md index 89d9f2d9d..709604010 100644 --- a/Readme.md +++ b/Readme.md @@ -71,9 +71,9 @@ http://localhost:8080/example/editor?fileExt=docx&userid=uid-1&lang=en&directUrl docker compose down ``` -> **Security note:** The compose file sets `JWT_SECRET=secret`. This is -> intentionally insecure and is only suitable for local development and -> testing. Never expose this setup to a public network. +> **Security note:** The compose file sets a default `JWT_SECRET` for local development only. +> Never expose this setup to a public network and always replace the secret with a strong, +> unique value in any non-development environment. ## API methods for test examples diff --git a/docker-compose.yml b/docker-compose.yml index b98f526d3..5b830b7fb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -45,7 +45,7 @@ services: image: ghcr.io/euro-office/documentserver:latest environment: EXAMPLE_ENABLED: "true" - JWT_SECRET: "secret" + JWT_SECRET: "euro-office-dev-jwt-secret-key-2026" container_name: eo-documentserver ports: - "8080:80" \ No newline at end of file diff --git a/web/documentserver-example/go/README.md b/web/documentserver-example/go/README.md index d46a73438..101d9222d 100644 --- a/web/documentserver-example/go/README.md +++ b/web/documentserver-example/go/README.md @@ -24,7 +24,7 @@ SERVER_PORT=port DOC_SERVER_HOST=http://documentserver/ JWT_IS_ENABLED=flag -JWT_SECRET=secret +JWT_SECRET=euro-office-dev-jwt-secret-key-2026 JWT_HEADER=Authorization ``` @@ -62,7 +62,7 @@ Also, [specify the same secret key](https://helpcenter.onlyoffice.com/installati ``` { - "JWT_SECRET" : "secret", + "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026", } ``` diff --git a/web/documentserver-example/go/config/configuration.json b/web/documentserver-example/go/config/configuration.json index 29c913b94..8d20fd33a 100644 --- a/web/documentserver-example/go/config/configuration.json +++ b/web/documentserver-example/go/config/configuration.json @@ -12,7 +12,7 @@ "JWT_IS_ENABLED" : false, "JWT_EXPIRES_IN" : 5, - "JWT_SECRET" : "secret", + "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026", "JWT_HEADER" : "Authorization", "STORAGE_PATH" : "filestore", diff --git a/web/documentserver-example/nodejs/docker-entrypoint.sh b/web/documentserver-example/nodejs/docker-entrypoint.sh index 553a37e49..1ecdc3c7e 100755 --- a/web/documentserver-example/nodejs/docker-entrypoint.sh +++ b/web/documentserver-example/nodejs/docker-entrypoint.sh @@ -6,7 +6,7 @@ export NODE_CONFIG='{ "exampleUrl": "'${EXAMPLE_URL:-http://localhost/example/}'", "token": { "enable": '${JWT_ENABLED:-false}', - "secret": "'${JWT_SECRET:-secret}'", + "secret": "'${JWT_SECRET:-euro-office-dev-jwt-secret-key-2026}'", "authorizationHeader": "'${JWT_HEADER:-Authorization}'" } } diff --git a/web/documentserver-example/php-laravel/.env.example b/web/documentserver-example/php-laravel/.env.example index f7f4a6d3d..c1e53d24a 100644 --- a/web/documentserver-example/php-laravel/.env.example +++ b/web/documentserver-example/php-laravel/.env.example @@ -29,7 +29,7 @@ DOCUMENT_SERVER_PRELOADER_PATH=web-apps/apps/api/documents/preload.html DOCUMENT_SERVER_JWT_HEADER=Authorization DOCUMENT_SERVER_JWT_ALGORITHM=HS256 DOCUMENT_SERVER_JWT_USE_FOR_REQUEST=true -DOCUMENT_SERVER_JWT_SECRET=secret +DOCUMENT_SERVER_JWT_SECRET=euro-office-dev-jwt-secret-key-2026 DOCUMENT_SERVER_JWT_EXPIRATION=5 DOCUMENT_SERVER_CONVERSION_TIMEOUT=120000 diff --git a/web/documentserver-example/php/docker-compose.yml b/web/documentserver-example/php/docker-compose.yml index 448fdfce8..acf105ec5 100644 --- a/web/documentserver-example/php/docker-compose.yml +++ b/web/documentserver-example/php/docker-compose.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -23,7 +23,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: diff --git a/web/documentserver-example/python/compose-base.yml b/web/documentserver-example/python/compose-base.yml index 71b020009..0ff39ef25 100644 --- a/web/documentserver-example/python/compose-base.yml +++ b/web/documentserver-example/python/compose-base.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -20,7 +20,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: diff --git a/web/documentserver-example/ruby/compose-base.yml b/web/documentserver-example/ruby/compose-base.yml index 73ba02ba0..3f26191a1 100644 --- a/web/documentserver-example/ruby/compose-base.yml +++ b/web/documentserver-example/ruby/compose-base.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -21,7 +21,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: From cd05dc92fa245e6d75237fad0d0b579e03732444 Mon Sep 17 00:00:00 2001 From: Christoph Schaefer Date: Thu, 6 Aug 2026 17:14:54 +0200 Subject: [PATCH 2/2] chore: finish the JWT secret sweep and stop defaulting Laravel to a secret Follow-up to review feedback on PR #13. Replace the remaining sub-32-character secrets so the repository no longer ships a value that trips the connector's 32-character minimum: - nodejs/config/default.json: this is what node-config actually loads when NODE_CONFIG is unset (running the example with `npm start`, outside Docker), so the entrypoint fix alone did not cover it. - README snippets users copy verbatim: nodejs, csharp, csharp-mvc, java and java-spring. - The "Example" column for JWT_SECRET in the php, php-laravel, python and ruby READMEs. These document an example rather than a default (the default in all four is an empty string, meaning JWT off), but the value shown was 19 characters and fails as soon as it is copied. - The env round-trip test fixtures, so that grepping for the old literals now returns nothing and the sweep stays verifiable. php-laravel's SettingsManager defaulted DOCUMENT_SERVER_JWT_SECRET to "secret", and it derives jwt.enabled from that value being truthy. That turned JWT on by default with a 6-character secret. Default it to an empty string instead, matching the php, python and ruby examples, so JWT stays off unless a secret is supplied rather than on with a public placeholder. Assisted-by: ClaudeCode:claude-opus-5 Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Christoph Schaefer --- web/documentserver-example/csharp-mvc/README.md | 2 +- web/documentserver-example/csharp/README.md | 2 +- web/documentserver-example/java-spring/README.md | 6 +++--- web/documentserver-example/java/README.md | 6 +++--- web/documentserver-example/nodejs/README.md | 4 ++-- web/documentserver-example/nodejs/config/default.json | 2 +- web/documentserver-example/php-laravel/README.md | 2 +- .../php-laravel/app/OnlyOffice/Managers/SettingsManager.php | 2 +- web/documentserver-example/php/README.md | 2 +- .../configuration/ConfigurationManagerJWTSecretTests.php | 4 ++-- web/documentserver-example/python/README.md | 2 +- .../python/src/configuration/configuration_tests.py | 4 ++-- web/documentserver-example/ruby/README.md | 2 +- .../ruby/app/configuration/configuration_tests.rb | 4 ++-- 14 files changed, 22 insertions(+), 22 deletions(-) diff --git a/web/documentserver-example/csharp-mvc/README.md b/web/documentserver-example/csharp-mvc/README.md index 93c4eda0f..102dadec5 100644 --- a/web/documentserver-example/csharp-mvc/README.md +++ b/web/documentserver-example/csharp-mvc/README.md @@ -43,7 +43,7 @@ Configure the IIS components for the server to work correctly: Open the *web.appsettings.config* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - + ``` ## Step 5. Run your website with the editors diff --git a/web/documentserver-example/csharp/README.md b/web/documentserver-example/csharp/README.md index db7617b1f..82a2d92d9 100644 --- a/web/documentserver-example/csharp/README.md +++ b/web/documentserver-example/csharp/README.md @@ -44,7 +44,7 @@ Configure the IIS components for the server to work correctly: Open the *settings.config* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - + ``` ## Step 5. Run your website with the editors diff --git a/web/documentserver-example/java-spring/README.md b/web/documentserver-example/java-spring/README.md index f5dd60703..f8925f9d9 100755 --- a/web/documentserver-example/java-spring/README.md +++ b/web/documentserver-example/java-spring/README.md @@ -99,7 +99,7 @@ To run the Java example code, install the Java version 11 appropriate for your O Open the *src/main/resouces/application.properties* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` -docservice.security.key=secret +docservice.security.key=euro-office-dev-jwt-secret-key-2026 ``` ### Step 6. Start application with Maven @@ -184,7 +184,7 @@ See the detailed guide to learn how to install Document Server [for Linux](https [Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - docservice.security.key=secret + docservice.security.key=euro-office-dev-jwt-secret-key-2026 ``` 5. Install **Maven**: @@ -275,7 +275,7 @@ See the detailed guide to learn how to install Document Server [for Docker](http [Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - docservice.security.key=secret + docservice.security.key=euro-office-dev-jwt-secret-key-2026 ``` 6. Run the next command in the java example directory: diff --git a/web/documentserver-example/java/README.md b/web/documentserver-example/java/README.md index 277544da8..82a5b4dd9 100644 --- a/web/documentserver-example/java/README.md +++ b/web/documentserver-example/java/README.md @@ -93,7 +93,7 @@ To run the Java example code, install the Java version appropriate for your OS a Open the *src/main/resouces/settings.properties* file and [specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` -files.docservice.secret=secret +files.docservice.secret=euro-office-dev-jwt-secret-key-2026 ``` ### Step 6. Run the Java code @@ -187,7 +187,7 @@ See the detailed guide to learn how to [install Document Server for Linux](https [Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - files.docservice.secret=secret + files.docservice.secret=euro-office-dev-jwt-secret-key-2026 ``` 5. Install **Maven**: @@ -295,7 +295,7 @@ See the detailed guide to learn how to install Document Server [for Docker](http [Specify the same secret key](https://helpcenter.onlyoffice.com/installation/docs-configure-jwt.aspx) as used in your Document Server to enable JWT: ``` - files.docservice.secret=secret + files.docservice.secret=euro-office-dev-jwt-secret-key-2026 ``` 6. Run the next command in the Java example directory: diff --git a/web/documentserver-example/nodejs/README.md b/web/documentserver-example/nodejs/README.md index a76934355..f8a84e049 100644 --- a/web/documentserver-example/nodejs/README.md +++ b/web/documentserver-example/nodejs/README.md @@ -52,7 +52,7 @@ Also, [specify the same secret key](https://helpcenter.onlyoffice.com/installati { "server": { "token": { - "secret": "secret" + "secret": "euro-office-dev-jwt-secret-key-2026" } } } @@ -173,7 +173,7 @@ See the detailed guide to learn how to [install Document Server for Linux](https { "server": { "token": { - "secret": "secret" + "secret": "euro-office-dev-jwt-secret-key-2026" } } } diff --git a/web/documentserver-example/nodejs/config/default.json b/web/documentserver-example/nodejs/config/default.json index f8a69cc8a..c192fa22b 100644 --- a/web/documentserver-example/nodejs/config/default.json +++ b/web/documentserver-example/nodejs/config/default.json @@ -34,7 +34,7 @@ "algorithmRequest": "HS256", "authorizationHeader": "Authorization", "authorizationHeaderPrefix": "Bearer ", - "secret": "secret", + "secret": "euro-office-dev-jwt-secret-key-2026", "expiresIn": "5m" }, "verify_peer_off": true, diff --git a/web/documentserver-example/php-laravel/README.md b/web/documentserver-example/php-laravel/README.md index e73e2bc51..3f4c0fa85 100644 --- a/web/documentserver-example/php-laravel/README.md +++ b/web/documentserver-example/php-laravel/README.md @@ -113,7 +113,7 @@ The following table shows the environment variables that is used to configure th | `DOCUMENT_STORAGE_PRIVATE_URL`| The URL address used by the Document Server to communicate with the server. | `http://proxy` | | `DOCUMENT_SERVER_PUBLIC_URL` | The URL address used by the client to communicate with the Document Server. | `http://localhost:8080` | | `DOCUMENT_SERVER_PRIVATE_URL` | The URL address used by the server to communicate with the Document Server. | `http://proxy:8080` | -| `DOCUMENT_SERVER_JWT_SECRET` | JWT authorization secret. | `your-256-bit-secret` | +| `DOCUMENT_SERVER_JWT_SECRET` | JWT authorization secret. | `euro-office-dev-jwt-secret-key-2026` | ## Troubleshooting diff --git a/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php b/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php index 69e573ea2..afea9b38b 100644 --- a/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php +++ b/web/documentserver-example/php-laravel/app/OnlyOffice/Managers/SettingsManager.php @@ -35,7 +35,7 @@ public function __construct() $preloaderUrl = $publicServerUrl.'/'.env('DOCUMENT_SERVER_PRELOADER_PATH', 'web-apps/apps/api/documents/preload.html'); $conversionUrl = $privateServerUrl.'/'.env('DOCUMENT_SERVER_CONVERTER_PATH', 'convert'); $commandUrl = $privateServerUrl.'/'.env('DOCUMENT_SERVER_COMMAND_PATH', 'command'); - $jwtSecret = env('DOCUMENT_SERVER_JWT_SECRET', 'secret'); + $jwtSecret = env('DOCUMENT_SERVER_JWT_SECRET', ''); $jwtExpiration = env('DOCUMENT_SERVER_JWT_EXPIRATION', 5); $jwtUseForRequest = env('DOCUMENT_SERVER_JWT_USE_FOR_REQUEST', true); $publicStorageUrl = rtrim(env('DOCUMENT_STORAGE_PUBLIC_URL', request()->schemeAndHttpHost()), '/'); diff --git a/web/documentserver-example/php/README.md b/web/documentserver-example/php/README.md index f2df1ccc2..664676421 100644 --- a/web/documentserver-example/php/README.md +++ b/web/documentserver-example/php/README.md @@ -73,7 +73,7 @@ The example is configured by changing environment variables. | `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` | | `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` | | `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` | -| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` | +| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` | ## Security Info diff --git a/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php b/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php index 75a710c0e..000a2d7ee 100644 --- a/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php +++ b/web/documentserver-example/php/src/configuration/ConfigurationManagerJWTSecretTests.php @@ -46,9 +46,9 @@ public function testAssignsADefaultValue() public function testAssignsAValueFromTheEnvironment() { - putenv('JWT_SECRET=your-256-bit-secret'); + putenv('JWT_SECRET=euro-office-dev-jwt-secret-key-2026'); $configManager = new ConfigurationManager(); $secret = $configManager->jwtSecret(); - $this->assertEquals('your-256-bit-secret', $secret); + $this->assertEquals('euro-office-dev-jwt-secret-key-2026', $secret); } } diff --git a/web/documentserver-example/python/README.md b/web/documentserver-example/python/README.md index cb7ae8408..38d9dae53 100755 --- a/web/documentserver-example/python/README.md +++ b/web/documentserver-example/python/README.md @@ -74,7 +74,7 @@ The example is configured by changing environment variables. | `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` | | `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` | | `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` | -| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` | +| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` | ## Security Info diff --git a/web/documentserver-example/python/src/configuration/configuration_tests.py b/web/documentserver-example/python/src/configuration/configuration_tests.py index 6a274bb31..171d68a95 100644 --- a/web/documentserver-example/python/src/configuration/configuration_tests.py +++ b/web/documentserver-example/python/src/configuration/configuration_tests.py @@ -203,12 +203,12 @@ def test_assigns_a_default_value(self): self.assertEqual(secret, '') @patch.dict(environ, { - 'JWT_SECRET': 'your-256-bit-secret' + 'JWT_SECRET': 'euro-office-dev-jwt-secret-key-2026' }) def test_assigns_a_value_from_the_environment(self): config_manager = ConfigurationManager() secret = config_manager.jwt_secret() - self.assertEqual(secret, 'your-256-bit-secret') + self.assertEqual(secret, 'euro-office-dev-jwt-secret-key-2026') class ConfigurationManagerJWTHeaderTests(TestCase): diff --git a/web/documentserver-example/ruby/README.md b/web/documentserver-example/ruby/README.md index c3fcfcfae..5a9a2af0e 100755 --- a/web/documentserver-example/ruby/README.md +++ b/web/documentserver-example/ruby/README.md @@ -72,7 +72,7 @@ The example is configured by changing environment variables. | `DOCUMENT_SERVER_PRIVATE_URL` | The URL through which the server will communicate with Document Server. | `http://proxy:8080` | | `DOCUMENT_SERVER_PUBLIC_URL` | The URL through which a user will communicate with Document Server. | `http://localhost:8080` | | `EXAMPLE_URL` | The URL through which Document Server will communicate with the server. | `http://proxy` | -| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `your-256-bit-secret` | +| `JWT_SECRET` | JWT authorization secret. Leave blank to disable authorization. | `euro-office-dev-jwt-secret-key-2026` | | `PORT` | The port on which the server should be running. | `80` | ## Security Info diff --git a/web/documentserver-example/ruby/app/configuration/configuration_tests.rb b/web/documentserver-example/ruby/app/configuration/configuration_tests.rb index 9260dda85..e2fd67820 100644 --- a/web/documentserver-example/ruby/app/configuration/configuration_tests.rb +++ b/web/documentserver-example/ruby/app/configuration/configuration_tests.rb @@ -201,10 +201,10 @@ def test_assigns_a_default_value end def test_assigns_a_value_from_the_environment - ENV['JWT_SECRET'] = 'your-256-bit-secret' + ENV['JWT_SECRET'] = 'euro-office-dev-jwt-secret-key-2026' config_manager = ConfigurationManager.new secret = config_manager.jwt_secret - assert_equal(secret, 'your-256-bit-secret') + assert_equal(secret, 'euro-office-dev-jwt-secret-key-2026') end end