I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key.

  1. In code - Not acceptable because my code is in a github repo
  2. ENV variable - seperate secrets for dev and production while not leaking to github
  3. Store in database - Seems more like 2nd option with more work, being that an on-machine attacker can find access to the db anyways

2nd option looks like the best method for a simple website (no super sensitive user info like credit cards or SSNs).

Is this a good solution?


I don’t think storing not only JWT secret but any kinds of secret like ssh keys, database passwords/username etc. in docker ENV is not ideal or recommended.

You can use Docker Secret for these kinds of things. Though I am not sure how to implement docker secret in your use case but I have used TLS certificates, ssh keys and various credentials on docker secret and passed among the swarm and it works every time.


Use environment variables as you said, just be careful in how you actually pass the value to the variable so that it doesn't leak to logs.

For example, instead of docker run -e SECRET=foo, use docker run -e SECRET=$(cat my_secret).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.