Do not put sensitive data in objects

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: typescript-node-security/jwt-sensitive-data

Language: TypeScript

Severity: Warning

Category: Security

CWE: 312

Description

Never include sensitive information in a JWT. Instead, only use non-personal information to identify the end-user.

Non-Compliant Code Examples

jwt.sign(
    { user: { email: 'foo@bar.com' }}
)

jwt.sign(
    { user: { lastname: 'babar' }}
)

Compliant Code Examples

jwt.sign(
    {user: { id: 42 }}
)
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis