Hacker News Reader

I do JWT token auth for apps as documented here:

https://github.com/nzoschke/gofaas/blob/master/docs/security...

In dev I run the same exact code and copy the JWT cookie from my production site.

Both dev and prod have the same secret to validate the cookie.

I wouldn't want to share keys like that. I'd also lose out on being able to modify my test account(s) with different groups/permissions that might not be in production yet.

You probably are well aware, but security wise that's a huge issue. If it's a hobby app, okay, but anything with actual users should separate keys. The main concern would be that dev keys are not considered secure and anyone with access to the dev key could then impersonate any other user of the production application.

Reply on news.ycombinator.com