mirror of
https://gitee.com/dromara/mayfly-go
synced 2026-05-28 22:05:18 +08:00
a17fa5a103
- Add HMAC algorithm verification in ParseToken to prevent JWT algorithm confusion attacks (CWE-347). Reject tokens with non-HMAC signing methods. - Replace hardcoded secrets in config.yml.example with empty values (JWT key, DB password, AES key) to prevent users from deploying with weak/known credentials (CWE-798).