Java : Hardcoded encryption key of JWT-token

Hardcoded encryption key can lead to the application data being compromised.

Eliminating the security risks related to keys being specified in the source code is extremely difficult. Such keys are available at least to every developer of the application. Moreover, after the application is installed, removing the key from its code is possible only via an update. Constant strings are easily extracted from the compiled application by decompilers. Therefore, an attacker does not necessarily need to have access to the source code to find out the value of the key.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.