From a75592028d2edb160c2f3c3486c3e527259440b3 Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Wed, 24 Jun 2026 20:12:57 +0000 Subject: [PATCH] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- docs_src/security/tutorial004_an_py310.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs_src/security/tutorial004_an_py310.py b/docs_src/security/tutorial004_an_py310.py index 685cb034e..d5c4deda5 100644 --- a/docs_src/security/tutorial004_an_py310.py +++ b/docs_src/security/tutorial004_an_py310.py @@ -1,3 +1,4 @@ +import os from datetime import datetime, timedelta, timezone from typing import Annotated @@ -10,7 +11,7 @@ from pydantic import BaseModel # to get a string like this run: # openssl rand -hex 32 -SECRET_KEY = "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7" +SECRET_KEY = os.getenv("SECRET_KEY", "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7") ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 30 @@ -97,7 +98,9 @@ async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]): headers={"WWW-Authenticate": "Bearer"}, ) try: - payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) + payload = jwt.decode( + token, SECRET_KEY, algorithms=[ALGORITHM], options={"require": ["exp"]} + ) username = payload.get("sub") if username is None: raise credentials_exception