From 41183fb4d84dd5d0f6abc463aecf4e6215084ea0 Mon Sep 17 00:00:00 2001 From: Christoph Schaefer Date: Wed, 24 Jun 2026 13:27:31 +0200 Subject: [PATCH] =?UTF-8?q?chore:=20replace=20short=20JWT=5FSECRET=20examp?= =?UTF-8?q?les=20with=20=E2=89=A532-char=20value?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The EuroOffice connector v11+ enforces a minimum JWT secret length of 32 characters. All example defaults ("secret", "your-256-bit-secret") were under this limit and would fail immediately at runtime. Replace with "euro-office-dev-jwt-secret-key-2026" (35 chars) in all compose files, entrypoints, .env.example, and READMEs. Update the Readme security note to no longer reference the old short literal. Assisted-by: ClaudeCode:claude-sonnet-4-6 --- Readme.md | 6 +++--- docker-compose.yml | 2 +- web/documentserver-example/go/README.md | 4 ++-- web/documentserver-example/go/config/configuration.json | 2 +- web/documentserver-example/nodejs/docker-entrypoint.sh | 2 +- web/documentserver-example/php-laravel/.env.example | 2 +- web/documentserver-example/php/docker-compose.yml | 4 ++-- web/documentserver-example/python/compose-base.yml | 4 ++-- web/documentserver-example/ruby/compose-base.yml | 4 ++-- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Readme.md b/Readme.md index 89d9f2d9d..709604010 100644 --- a/Readme.md +++ b/Readme.md @@ -71,9 +71,9 @@ http://localhost:8080/example/editor?fileExt=docx&userid=uid-1&lang=en&directUrl docker compose down ``` -> **Security note:** The compose file sets `JWT_SECRET=secret`. This is -> intentionally insecure and is only suitable for local development and -> testing. Never expose this setup to a public network. +> **Security note:** The compose file sets a default `JWT_SECRET` for local development only. +> Never expose this setup to a public network and always replace the secret with a strong, +> unique value in any non-development environment. ## API methods for test examples diff --git a/docker-compose.yml b/docker-compose.yml index b98f526d3..5b830b7fb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -45,7 +45,7 @@ services: image: ghcr.io/euro-office/documentserver:latest environment: EXAMPLE_ENABLED: "true" - JWT_SECRET: "secret" + JWT_SECRET: "euro-office-dev-jwt-secret-key-2026" container_name: eo-documentserver ports: - "8080:80" \ No newline at end of file diff --git a/web/documentserver-example/go/README.md b/web/documentserver-example/go/README.md index d46a73438..101d9222d 100644 --- a/web/documentserver-example/go/README.md +++ b/web/documentserver-example/go/README.md @@ -24,7 +24,7 @@ SERVER_PORT=port DOC_SERVER_HOST=http://documentserver/ JWT_IS_ENABLED=flag -JWT_SECRET=secret +JWT_SECRET=euro-office-dev-jwt-secret-key-2026 JWT_HEADER=Authorization ``` @@ -62,7 +62,7 @@ Also, [specify the same secret key](https://helpcenter.onlyoffice.com/installati ``` { - "JWT_SECRET" : "secret", + "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026", } ``` diff --git a/web/documentserver-example/go/config/configuration.json b/web/documentserver-example/go/config/configuration.json index 29c913b94..8d20fd33a 100644 --- a/web/documentserver-example/go/config/configuration.json +++ b/web/documentserver-example/go/config/configuration.json @@ -12,7 +12,7 @@ "JWT_IS_ENABLED" : false, "JWT_EXPIRES_IN" : 5, - "JWT_SECRET" : "secret", + "JWT_SECRET" : "euro-office-dev-jwt-secret-key-2026", "JWT_HEADER" : "Authorization", "STORAGE_PATH" : "filestore", diff --git a/web/documentserver-example/nodejs/docker-entrypoint.sh b/web/documentserver-example/nodejs/docker-entrypoint.sh index 553a37e49..1ecdc3c7e 100755 --- a/web/documentserver-example/nodejs/docker-entrypoint.sh +++ b/web/documentserver-example/nodejs/docker-entrypoint.sh @@ -6,7 +6,7 @@ export NODE_CONFIG='{ "exampleUrl": "'${EXAMPLE_URL:-http://localhost/example/}'", "token": { "enable": '${JWT_ENABLED:-false}', - "secret": "'${JWT_SECRET:-secret}'", + "secret": "'${JWT_SECRET:-euro-office-dev-jwt-secret-key-2026}'", "authorizationHeader": "'${JWT_HEADER:-Authorization}'" } } diff --git a/web/documentserver-example/php-laravel/.env.example b/web/documentserver-example/php-laravel/.env.example index f7f4a6d3d..c1e53d24a 100644 --- a/web/documentserver-example/php-laravel/.env.example +++ b/web/documentserver-example/php-laravel/.env.example @@ -29,7 +29,7 @@ DOCUMENT_SERVER_PRELOADER_PATH=web-apps/apps/api/documents/preload.html DOCUMENT_SERVER_JWT_HEADER=Authorization DOCUMENT_SERVER_JWT_ALGORITHM=HS256 DOCUMENT_SERVER_JWT_USE_FOR_REQUEST=true -DOCUMENT_SERVER_JWT_SECRET=secret +DOCUMENT_SERVER_JWT_SECRET=euro-office-dev-jwt-secret-key-2026 DOCUMENT_SERVER_JWT_EXPIRATION=5 DOCUMENT_SERVER_CONVERSION_TIMEOUT=120000 diff --git a/web/documentserver-example/php/docker-compose.yml b/web/documentserver-example/php/docker-compose.yml index 448fdfce8..acf105ec5 100644 --- a/web/documentserver-example/php/docker-compose.yml +++ b/web/documentserver-example/php/docker-compose.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -23,7 +23,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: diff --git a/web/documentserver-example/python/compose-base.yml b/web/documentserver-example/python/compose-base.yml index 71b020009..0ff39ef25 100644 --- a/web/documentserver-example/python/compose-base.yml +++ b/web/documentserver-example/python/compose-base.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -20,7 +20,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: diff --git a/web/documentserver-example/ruby/compose-base.yml b/web/documentserver-example/ruby/compose-base.yml index 73ba02ba0..3f26191a1 100644 --- a/web/documentserver-example/ruby/compose-base.yml +++ b/web/documentserver-example/ruby/compose-base.yml @@ -7,7 +7,7 @@ services: expose: - "80" environment: - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 example: container_name: example @@ -21,7 +21,7 @@ services: - DOCUMENT_SERVER_PRIVATE_URL=http://proxy:8080 - DOCUMENT_SERVER_PUBLIC_URL=http://localhost:8080 - EXAMPLE_URL=http://proxy - - JWT_SECRET=your-256-bit-secret + - JWT_SECRET=euro-office-dev-jwt-secret-key-2026 - PORT=80 proxy: