Default JWT secret

[twobeeb]

The default behavior when micronaut.security.token.jwt.signatures.secret.generator.secret is not set is to generate a JWT without signature, that lets anyone change its claim effortless.

I believe this is a security flaw and AKHQ should not even start if there is no secret, or at least there should be a default secret, along with a warning log at run time when the secret have not been changed.

[tchiotludo]

I think Micronaut will crashed on this case, don't know if we need to report it to micronaut or handle it on akhq

[twobeeb]

For reference, what another project did (not using micronaut though)
https://github.com/gravitee-io/gravitee-management-rest-api/blob/master/gravitee-rest-api-management/gravitee-rest-api-management-security/src/main/java/io/gravitee/rest/api/management/security/config/BasicSecurityConfigurerAdapter.java#L179-L197

[tchiotludo]

Got idea, I'll start like that :)
Thanks