fix: #431 use a dedicated secret for jwt

Author: payamnj

django_email_learning/apps.py

@@ -9,28 +9,42 @@ def check_site_base_url_config(app_configs, **kwargs):  # type: ignore[no-untype
     errors = []
     from django.conf import settings
 
-    if (
-        not hasattr(settings, "DJANGO_EMAIL_LEARNING")
-        or "SITE_BASE_URL" not in settings.DJANGO_EMAIL_LEARNING
+    if not hasattr(settings, "DJANGO_EMAIL_LEARNING") or not isinstance(
+        settings.DJANGO_EMAIL_LEARNING, dict
     ):
+        errors.append(
+            checks.Error(
+                "DJANGO_EMAIL_LEARNING is not set in settings or is not a dictionary.",
+                hint="Please set DJANGO_EMAIL_LEARNING to a dictionary containing the required configurations.",
+                id="django_email_learning.E000",
+            )
+        )
+        return errors
+
+    if "SITE_BASE_URL" not in settings.DJANGO_EMAIL_LEARNING:
         errors.append(
             checks.Error(
                 "DJANGO_EMAIL_LEARNING['SITE_BASE_URL'] is not set in settings.",
                 hint="Please set DJANGO_EMAIL_LEARNING['SITE_BASE_URL'] to the base URL of your site.",
                 id="django_email_learning.E001",
             )
         )
-    if (
-        not hasattr(settings, "DJANGO_EMAIL_LEARNING")
-        or "ENCRYPTION_SECRET_KEY" not in settings.DJANGO_EMAIL_LEARNING
-    ):
+    if "ENCRYPTION_SECRET_KEY" not in settings.DJANGO_EMAIL_LEARNING:
         errors.append(
             checks.Error(
                 "DJANGO_EMAIL_LEARNING['ENCRYPTION_SECRET_KEY'] is not set in settings.",
                 hint="Please set DJANGO_EMAIL_LEARNING['ENCRYPTION_SECRET_KEY'] to a long, random string.",
                 id="django_email_learning.E002",
             )
         )
+    if "JWT_SECRET_KEY" not in settings.DJANGO_EMAIL_LEARNING:
+        errors.append(
+            checks.Error(
+                "DJANGO_EMAIL_LEARNING['JWT_SECRET_KEY'] is not set in settings.",
+                hint="Please set DJANGO_EMAIL_LEARNING['JWT_SECRET_KEY'] to a long, random string.",
+                id="django_email_learning.E003",
+            )
+        )
     return errors
 
 

django_email_learning/services/jwt_service.py

@@ -3,7 +3,8 @@
 import datetime
 import jwt
 
-SECRET = settings.SECRET_KEY
+
+SECRET = settings.DJANGO_EMAIL_LEARNING["JWT_SECRET_KEY"]
 ALGORITHM = "HS256"
 
 
@@ -24,13 +25,13 @@ def generate_jwt(
     if not exp:
         exp = timezone.now() + datetime.timedelta(seconds=expiration_seconds)
     payload_copy["exp"] = exp
-    token = jwt.encode(payload_copy, SECRET, algorithm=ALGORITHM)
+    token = jwt.encode(payload_copy, SECRET, algorithm=ALGORITHM)  # type: ignore[arg-type]
     return token
 
 
 def decode_jwt(token: str) -> dict:
     try:
-        decoded = jwt.decode(token, SECRET, algorithms=[ALGORITHM])
+        decoded = jwt.decode(token, SECRET, algorithms=[ALGORITHM])  # type: ignore[arg-type]
         return decoded
     except (jwt.InvalidSignatureError, jwt.DecodeError, jwt.InvalidAlgorithmError):
         raise InvalidTokenException("The signature is invalid")

django_service/settings.py

@@ -105,7 +105,8 @@
 
 DJANGO_EMAIL_LEARNING = {
     "SITE_BASE_URL": "http://localhost:8000",
-    "ENCRYPTION_SECRET_KEY": "your-very-secure-and-random-key",
+    "JWT_SECRET_KEY": "your-very-asdasdasdasdaasdawqA2eSDFaasecret-keym0824+s26vkron%(@whp&wyaw=26",
+    "ENCRYPTION_SECRET_KEY": "your-very-asdasdasdasecure-and-random-jwt-secret-keym0824+s26vkron%(@whp&wyaw=26",
     "FROM_EMAIL": os.environ.get("FROM_EMAIL", "webmaster@localhost"),
     "TERMS_OF_SERVICE_URL": "https://www.example.com/terms",
     "AI": {

docs/source/installation.rst

@@ -115,11 +115,21 @@ Same as all other sensitive configurations, it's a good practice to load this fr
    Changing this key after data has been created will prevent access to previously encrypted data. Chaning requires re-encrypting all existing data with the new key.
 
 
+**JWT_SECRET_KEY**
+
+A dedicated secret key used for signing and verifying JSON Web Tokens (JWTs). It should be a long, random string, independent of Django's ``SECRET_KEY`` and ``ENCRYPTION_SECRET_KEY``.
+
+Using a separate key ensures that a JWT secret compromise does not affect other parts of your application.
+
+Same as all other sensitive configurations, it's a good practice to load this from an environment variable or a secure vault.
+
+
 .. code-block:: python
 
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
     }
 
 
@@ -135,6 +145,7 @@ The default email address for outgoing course emails. If not specified, falls ba
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'FROM_EMAIL': 'courses@yourdomain.com',
     }
 
@@ -147,6 +158,7 @@ Optional link to your terms of service. When provided, this link is displayed in
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'TERMS_OF_SERVICE_URL': 'https://yourdomain.com/terms',
     }
 
@@ -165,6 +177,7 @@ All values are boolean.
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'QUIZ_DEFAULTS': {
             'LIMITED_ATTEMPTS': True,
             'IS_BLOCKING': True,
@@ -185,6 +198,7 @@ Optional configuration for injecting a custom component in the platform sidebar.
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'SIDEBAR': {
             'CUSTOM_COMPONENT': {
                 'SCRIPT_URL': 'url/path-to-your-component.js',
@@ -209,6 +223,7 @@ Optional configuration for branding assets in the platform header.
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'LOGO': {
             'HORIZONTAL_LOCKUP': {
                 'LIGHT_BACKGROUND': 'url/path-to-horizontal-logo-for-light-background.png',
@@ -232,6 +247,7 @@ If not specified, a default location will be used.
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'PRIVATE_FILE_STORAGE_LOCATION': '/path/to/private/storage/',
     }
 
@@ -275,6 +291,7 @@ Currently supported built-in models are:
     DJANGO_EMAIL_LEARNING = {
         'SITE_BASE_URL': 'https://yourdomain.com',
         'ENCRYPTION_SECRET_KEY': 'your-very-long-random-string',
+        'JWT_SECRET_KEY': 'another-very-long-random-string',
         'AI': {
             'OPENAI_API_KEY': os.environ.get('OPENAI_API_KEY'),
             'TEXT_EDITING_MODEL': LanguageModel.GPT_4O_MINI.model_name,

tests/test_models/test_delivery_schedule.py

@@ -58,7 +58,7 @@ def test_generate_link_assignment_with_zero_deadline_uses_datetime_max_exp(
     token = parse_qs(urlparse(link).query)["token"][0]
     decoded_token = jwt.decode(
         token,
-        settings.SECRET_KEY,
+        settings.DJANGO_EMAIL_LEARNING["JWT_SECRET_KEY"],
         algorithms=["HS256"],
         options={"verify_exp": False},
     )
@@ -69,7 +69,7 @@ def test_generate_link_assignment_with_zero_deadline_uses_datetime_max_exp(
     )
     expected_decoded = jwt.decode(
         expected_token,
-        settings.SECRET_KEY,
+        settings.DJANGO_EMAIL_LEARNING["JWT_SECRET_KEY"],
         algorithms=["HS256"],
         options={"verify_exp": False},
     )