fix: replace hardcoded JWT keys and add auth middleware (CWE-798, CWE-862)

[saaa99999999]

Three demo applications in this repo ship with hardcoded JWT signing keys and unprotected CRUD endpoints. Developers who copy these official examples get these problems directly in their own code.

1. hertz_jwt — JWT key hardcoded as "secret key"

bizdemo/hertz_jwt/biz/mw/jwt.go:39:

JwtMiddleware, err = jwt.New(&jwt.HertzJWTMiddleware{
    Realm:         "test zone",
    Key:           []byte("secret key"),
    Timeout:       time.Hour,
    // ...
})

The string "secret key" is the HMAC signing key for all JWT tokens in this demo. Anyone who reads the repo can forge tokens for any identity.

import jwt
token = jwt.encode({"identity": "admin", "exp": 9999999999}, "secret key", algorithm="HS256")
# This token passes all auth checks

Fixed by reading from env var, exiting cleanly if not set:

func getJWTKey() []byte {
    key := os.Getenv("JWT_SECRET_KEY")
    if key == "" {
        fmt.Fprintf(os.Stderr, "fatal: JWT_SECRET_KEY is not set. Generate one with: openssl rand -base64 32
")
        os.Exit(1)
    }
    return []byte(key)
}
// ...
Key: getJWTKey(),

2. tiktok_demo — JWT key hardcoded as "tiktok secret key"

bizdemo/tiktok_demo/biz/mw/jwt/jwt.go:47:

JwtMiddleware, _ = jwt.New(&jwt.HertzJWTMiddleware{
    Key:         []byte("tiktok secret key"),
    TokenLookup: "query:token,form:token",
    // ...
})

Same pattern. The key is in the public repo. Plus TokenLookup allows tokens via URL query parameters, which means tokens leak into browser history and server logs.

Fixed the same way — reads from TIKTOK_JWT_SECRET_KEY env var, exits cleanly if missing.

3. hertz_gorm — user CRUD endpoints have no authentication

bizdemo/hertz_gorm/biz/router/user_gorm/middleware.go:

func _createuserMw() []app.HandlerFunc { return nil }
func _deleteuserMw() []app.HandlerFunc { return nil }
func _queryuserMw()  []app.HandlerFunc { return nil }
func _updateuserMw() []app.HandlerFunc { return nil }

All four middleware stubs return nil. These protect POST endpoints:

• /v1/user/create/
• /v1/user/update/:user_id
• /v1/user/delete/:user_id
• /v1/user/query/

Without auth middleware, anyone can create, read, update, or delete any user in the database.

Fixed by applying JWT middleware to all four endpoints:

func _createuserMw() []app.HandlerFunc {
    return []app.HandlerFunc{jwtMiddleware.MiddlewareFunc()}
}
// same for _deleteuserMw, _queryuserMw, _updateuserMw

---

CWE-798 / CWE-862

[CLAassistant]

All committers have signed the CLA.