fix(security): never sign tokens with a known JWT secret (FLAW-04)

Without JWT_SECRET, or with one of the published placeholders, the server
generates 32 random bytes once and keeps them in the data directory
(jwt.secret, mode 0600), so tokens cannot be forged and logins survive
restarts. Instances that ran on the old default log in once more.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/config/config.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -37,6 +39,50 @@ type LegalTexts struct {
 	PrivacyURL, PrivacyContent string
 }
 
+// Publicly known JWT secrets (old code default and the placeholders from .env.example, compose and
+// README). Signing with one of them would let anyone forge login tokens.
+var insecureJWTSecrets = map[string]bool{
+	"mindsift-default-selfhosted-jwt-secret-key-2026": true,
+	"change_this_to_a_secure_random_key_min_32_chars": true,
+	"hier-ein-langer-zufaelliger-wert":                true,
+	"changeme":                                        true,
+	"secret":                                          true,
+}
+
+const jwtSecretFile = "jwt.secret"
+
+// resolveJWTSecret uses JWT_SECRET when it is set to a real value. Otherwise it generates a random
+// secret once and keeps it in the data directory, so logins survive restarts without anybody being
+// able to forge tokens with a known default.
+func resolveJWTSecret(fromEnv, dataDir string) string {
+	if v := strings.TrimSpace(fromEnv); v != "" && !insecureJWTSecrets[v] {
+		if len(v) < 32 {
+			slog.Warn("JWT_SECRET ist kürzer als 32 Zeichen – bitte einen längeren Zufallswert verwenden")
+		}
+		return v
+	} else if v != "" {
+		slog.Warn("JWT_SECRET ist ein öffentlich bekannter Platzhalter und wird ignoriert")
+	}
+	path := filepath.Join(dataDir, jwtSecretFile)
+	if data, err := os.ReadFile(path); err == nil {
+		if s := strings.TrimSpace(string(data)); len(s) >= 32 {
+			return s
+		}
+	}
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		panic("crypto/rand: " + err.Error())
+	}
+	secret := hex.EncodeToString(buf)
+	_ = os.MkdirAll(dataDir, 0o755)
+	if err := os.WriteFile(path, []byte(secret+"\n"), 0o600); err != nil {
+		slog.Error("Erzeugtes JWT-Secret konnte nicht gespeichert werden – Anmeldungen gelten nur bis zum Neustart", "pfad", path, "error", err)
+	} else {
+		slog.Warn("Kein JWT_SECRET gesetzt: zufälliges Secret erzeugt und im Datenverzeichnis gespeichert. Für Produktion besser JWT_SECRET setzen.", "pfad", path)
+	}
+	return secret
+}
+
 // legalContent reads Markdown from NAME or, for longer texts, from the file named in NAME_FILE.
 func legalContent(name string) string {
 	if v := strings.TrimSpace(os.Getenv(name)); v != "" {
@@ -78,7 +124,7 @@ func Load() *Config {
 		dbPath = dbURL
 	}
 
-	jwtSecret := getEnv("JWT_SECRET", "mindsift-default-selfhosted-jwt-secret-key-2026")
+	jwtSecret := resolveJWTSecret(os.Getenv("JWT_SECRET"), filepath.Dir(dbPath))
 	baseURL := getEnv("BASE_URL", "http://localhost:"+port)
 	allowReg := strings.ToLower(getEnv("ALLOW_REGISTRATION", "false")) == "true"
 

internal/config/config_test.go

@@ -3,10 +3,13 @@ package config
 import (
 	"log/slog"
 	"os"
+	"path/filepath"
 	"testing"
 )
 
 func TestConfigLogLevelAndDebug(t *testing.T) {
+	// Load writes the generated JWT secret into the data directory; keep it out of the repository
+	t.Setenv("DATA_DIR", t.TempDir())
 	os.Setenv("PORT", "9090")
 	defer os.Unsetenv("PORT")
 
@@ -56,3 +59,25 @@ func TestConfigLogLevelAndDebug(t *testing.T) {
 	os.Unsetenv("DEBUG")
 	os.Unsetenv("LOG_LEVEL")
 }
+
+func TestJWTSecretNeverUsesAKnownDefault(t *testing.T) {
+	dir := t.TempDir()
+	for _, env := range []string{"", "mindsift-default-selfhosted-jwt-secret-key-2026", "change_this_to_a_secure_random_key_min_32_chars"} {
+		got := resolveJWTSecret(env, dir)
+		if got == env || len(got) < 32 {
+			t.Fatalf("env %q: insecure secret %q", env, got)
+		}
+	}
+	// The generated secret is stable across restarts
+	first := resolveJWTSecret("", dir)
+	if again := resolveJWTSecret("", dir); again != first {
+		t.Fatalf("generated secret must persist, got %q then %q", first, again)
+	}
+	info, err := os.Stat(filepath.Join(dir, jwtSecretFile))
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("secret file must exist with mode 0600: %v %v", info, err)
+	}
+	if got := resolveJWTSecret("ein-eigener-sehr-langer-zufaelliger-wert-123456", dir); got != "ein-eigener-sehr-langer-zufaelliger-wert-123456" {
+		t.Fatalf("a real JWT_SECRET must win, got %q", got)
+	}
+}