I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key.
- In code - Not acceptable because my code is in a github repo
- ENV variable - seperate secrets for dev and production while not leaking to github
- Store in database - Seems more like 2nd option with more work, being that an on-machine attacker can find access to the db anyways
2nd option looks like the best method for a simple website (no super sensitive user info like credit cards or SSNs).
Is this a good solution?