Pardon if this is a noob question. I'm writing an authorization function to determine if a REST API request should be allowed to proceed or not. It is using a standard JWT passed in the
Authorization: Bearer ... header. For unit testing purposes, I've created some dummy JWTs that will allow me to test my function in a variety of scenarios (e.g. JWT expired,
sub not in database, etc.), and that are signed with a public/private key pair derived from a self-signed root CA created with
The key pair is not being used to secure anything of significance. I generated them mainly so that I could interact with my local dev server (an alias of
localhost) over HTTPS while doing web development (as described here). That being said, I have configured my local machine to "always trust" the self-signed root CA generated by
If I decide to distribute my authorization function (as an
npm package, for example), that would mean uploading my public/private key pair (upon which the unit tests depend) to an openly accessible location, i.e. a GitHub repo.
What are the practical implications of sharing a private key derived from a self-signed root CA? The FQDN is something like
api.example.test. Would I be giving some clever attacker a vector into my local machine? Is there a different/better way for me to generate a public/private key pair that is okay to distribute along with a software library? Let's say somebody liked my authorization function and wanted to download my code and run the unit tests for themselves--would they even be able to run the tests without also having the root CA from which they were derived?
Thanks for your feedback!!!