Course

In this lab, you are presented with the vulnerable code and a patch that fixes the issue. The goal is to analyze the code and attempt to identify the vulnerability on your own before reviewing the provided patch. This approach helps you develop your code review skills and better understand common vulnerabilities and their mitigations.

The specific example given involves a Java class `JJwtTool` used for JWT token generation and validation. Initially, the `secret` key is hard-coded, which is a security risk. The patched version introduces configuration properties to securely manage the `secret` key and caches JWT tokens to prevent replay attacks. By comparing the original and patched versions, you can see how these changes enhance security.