fix: express-jwt vulnerability (#569)

ForestAdmin · May 31, 2021 · ebb5f0a · ebb5f0a
1 parent c713c63
commit ebb5f0a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/services/dumper.js b/services/dumper.js
@@ -91,7 +91,7 @@ class Dumper {
       debug: '~4.0.1',
       dotenv: '~6.1.0',
       express: '~4.17.1',
-      'express-jwt': '5.3.1',
+      'express-jwt': '6.0.0',
       [`forest-express-${orm}`]: '^7.0.0',
       morgan: '1.9.1',
       'require-all': '^3.0.0',

diff --git a/templates/app/app.hbs b/templates/app/app.hbs
@@ -43,6 +43,7 @@ app.use(express.static(path.join(__dirname, 'public')));
 app.use(jwt({
   secret: process.env.FOREST_AUTH_SECRET,
   credentialsRequired: false,
+  algorithms: ['HS256'],
 }));
 
 app.use('/forest', (request, response, next) => {