Sync with develop #19
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -3,6 +3,9 @@ | |||
| /node_modules | |||
| /build | |||
|
|
|||
| # migration files | |||
| /prisma/Scorecards | |||
There was a problem hiding this comment.
Consider specifying the file types or patterns to ignore within the /prisma/Scorecards directory to avoid unintentionally ignoring necessary files.
| @@ -38,7 +38,14 @@ async function bootstrap() { | |||
| credentials: true, | |||
| origin: process.env.CORS_ALLOWED_ORIGIN | |||
| ? new RegExp(process.env.CORS_ALLOWED_ORIGIN) | |||
There was a problem hiding this comment.
Using new RegExp(process.env.CORS_ALLOWED_ORIGIN) can lead to unexpected behavior if the environment variable is not properly formatted as a regular expression. Consider validating or sanitizing the input to ensure it is a valid regex pattern.
| @@ -94,10 +94,12 @@ export class JwtService implements OnModuleInit { | |||
| // Get the signing key from Auth0 | |||
| const signingKey = await this.getSigningKey(tokenHeader.kid); | |||
|
|
|||
| console.log(`Signing key: ${JSON.stringify(signingKey)}`); | |||
There was a problem hiding this comment.
Consider removing the console.log statement or replacing it with a proper logging mechanism if needed for debugging purposes. Using console.log in production code can lead to performance issues and may expose sensitive information.
| // Verify options | ||
| const verifyOptions: VerifyOptions = { | ||
| issuer: AuthConfig.jwt.issuer, | ||
| audience: AuthConfig.jwt.audience, | ||
| //issuer: AuthConfig.jwt.issuer, |
There was a problem hiding this comment.
Commenting out the issuer and audience fields in verifyOptions might affect the security and validity of the JWT verification process. Ensure that these fields are intentionally omitted and that their absence does not compromise the application's security requirements.
| @@ -117,6 +119,7 @@ export class JwtService implements OnModuleInit { | |||
| throw new UnauthorizedException('Invalid token'); | |||
| } | |||
|
|
|||
| console.log(`Decoded token: ${JSON.stringify(decodedToken)}`); | |||
There was a problem hiding this comment.
Using console.log for logging decoded tokens can expose sensitive information in production environments. Consider using a more secure logging mechanism or remove this statement if not necessary.
No description provided.