starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-25 16:55:59 +03:00

[GH-ISSUE #4479] [bug] JwtStrategy requires a secret or key #1641

New issue

Closed

opened 2026-03-16 21:12:35 +03:00 by kerem · 8 comments

kerem commented

2026-03-16 21:12:35 +03:00

Owner

Originally created by @crocofied on GitHub (Oct 25, 2024).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4479

Is there an existing issue for this?

I have searched the existing issues

Current behavior

When I use the following .env:


#-----------------------Backend Config------------------------------#
# Prisma Config
DATABASE_URL=postgresql://postgres:**@***.***.**:11001/postgres # or replace with your database URL

# Auth Tokens Config
JWT_SECRET="**"
TOKEN_SALT_COMPLEXITY=10
MAGIC_LINK_TOKEN_VALIDITY=3
REFRESH_TOKEN_VALIDITY=604800000 # Default validity is 7 days (604800000 ms) in ms
ACCESS_TOKEN_VALIDITY=86400000 # Default validity is 1 day (86400000 ms) in ms
SESSION_SECRET="***"

# Recommended to be true. Set to false if you are using http.
# Note: Some auth providers may not support http requests and may stop working when set to false.
ALLOW_SECURE_COOKIES=true

# Sensitive Data Encryption Key while storing in Database (32 character)
DATA_ENCRYPTION_KEY=***

# Hoppscotch App Domain Config
REDIRECT_URL=https://hoppscotch.**.de/
WHITELISTED_ORIGINS=https://hoppscotch.**.de/,https://hoppscotch.***.de/backend,https://hoppscotch.**.de/admin
VITE_ALLOWED_AUTH_PROVIDERS="email"

# Mailer config
MAILER_SMTP_ENABLE=true
MAILER_USE_CUSTOM_CONFIGS=false
MAILER_ADDRESS_FROM=system@headlessdev.de
MAILER_SMTP_URL="smtps://system@****.de:******@mail.****.de"

# Rate Limit Config
RATE_LIMIT_TTL=60 # In seconds
RATE_LIMIT_MAX=100 # Max requests per IP

#-----------------------Frontend Config------------------------------#

# Base URLs
VITE_BASE_URL=https://hoppscotch.****.de/
VITE_SHORTCODE_BASE_URL=https://hoppscotch.****.de/
VITE_ADMIN_URL=https://hoppscotch.****.de/admin

# Backend URLs
VITE_BACKEND_GQL_URL=https://hoppscotch.******.de/graphql
VITE_BACKEND_WS_URL=wss://hoppscotch.****.de/graphql
VITE_BACKEND_API_URL=https://hoppscotch.*****.de/v1

# Terms Of Service And Privacy Policy Links (Optional)
VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms
VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy

# Set to `true` for subpath based access
ENABLE_SUBPATH_BASED_ACCESS=true

And this docker compose:


services:
  hoppscotch:
    image: hoppscotch/hoppscotch
    ports:
      - "11011:3000"
      - "11012:3100"
      - "11013:3170"
    env_file: .env
    restart: unless-stopped

I get this error on startup:
Backend Server | [Nest] 37 - 10/25/2024, 5:41:26 PM ERROR ;5;3m[ExceptionHandler] JwtStrategy requires a secret or key Backend Server | TypeError: JwtStrategy requires a secret or key Backend Server | at new JwtStrategy (/dist/backend/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:45:15) Backend Server | at new MixinStrategy (/dist/backend/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1__owspyaltb3hygw66etzcv5nnwq/node_modules/@nestjs/passport/dist/passport/passport.strategy.js:32:13) Backend Server | at new JwtStrategy (/dist/backend/dist/auth/strategies/jwt.strategy.js:22:9) Backend Server | at Injector.instantiateClass (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:365:19) Backend Server | at callback (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:65:45) Backend Server | at async Injector.resolveConstructorParams (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:144:24) Backend Server | at async Injector.loadInstance (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:70:13) Backend Server | at async Injector.loadProvider (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:97:9) Backend Server | at async /dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/instance-loader.js:56:13 Backend Server | at async Promise.all (index 4) Exiting process because Backend Server exited with code 1

Steps to reproduce

use the env and docker compose
Start the application

Environment

Production

Version

Self-hosted

Originally created by @crocofied on GitHub (Oct 25, 2024). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4479 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When I use the following .env: ``` #-----------------------Backend Config------------------------------# # Prisma Config DATABASE_URL=postgresql://postgres:**@***.***.**:11001/postgres # or replace with your database URL # Auth Tokens Config JWT_SECRET="**" TOKEN_SALT_COMPLEXITY=10 MAGIC_LINK_TOKEN_VALIDITY=3 REFRESH_TOKEN_VALIDITY=604800000 # Default validity is 7 days (604800000 ms) in ms ACCESS_TOKEN_VALIDITY=86400000 # Default validity is 1 day (86400000 ms) in ms SESSION_SECRET="***" # Recommended to be true. Set to false if you are using http. # Note: Some auth providers may not support http requests and may stop working when set to false. ALLOW_SECURE_COOKIES=true # Sensitive Data Encryption Key while storing in Database (32 character) DATA_ENCRYPTION_KEY=*** # Hoppscotch App Domain Config REDIRECT_URL=https://hoppscotch.**.de/ WHITELISTED_ORIGINS=https://hoppscotch.**.de/,https://hoppscotch.***.de/backend,https://hoppscotch.**.de/admin VITE_ALLOWED_AUTH_PROVIDERS="email" # Mailer config MAILER_SMTP_ENABLE=true MAILER_USE_CUSTOM_CONFIGS=false MAILER_ADDRESS_FROM=system@headlessdev.de MAILER_SMTP_URL="smtps://system@****.de:******@mail.****.de" # Rate Limit Config RATE_LIMIT_TTL=60 # In seconds RATE_LIMIT_MAX=100 # Max requests per IP #-----------------------Frontend Config------------------------------# # Base URLs VITE_BASE_URL=https://hoppscotch.****.de/ VITE_SHORTCODE_BASE_URL=https://hoppscotch.****.de/ VITE_ADMIN_URL=https://hoppscotch.****.de/admin # Backend URLs VITE_BACKEND_GQL_URL=https://hoppscotch.******.de/graphql VITE_BACKEND_WS_URL=wss://hoppscotch.****.de/graphql VITE_BACKEND_API_URL=https://hoppscotch.*****.de/v1 # Terms Of Service And Privacy Policy Links (Optional) VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy # Set to `true` for subpath based access ENABLE_SUBPATH_BASED_ACCESS=true ``` And this docker compose: ``` services: hoppscotch: image: hoppscotch/hoppscotch ports: - "11011:3000" - "11012:3100" - "11013:3170" env_file: .env restart: unless-stopped ``` I get this error on startup: `Backend Server | [Nest] 37 - 10/25/2024, 5:41:26 PM ERROR ;5;3m[ExceptionHandler] JwtStrategy requires a secret or key Backend Server | TypeError: JwtStrategy requires a secret or key Backend Server | at new JwtStrategy (/dist/backend/node_modules/.pnpm/passport-jwt@4.0.1/node_modules/passport-jwt/lib/strategy.js:45:15) Backend Server | at new MixinStrategy (/dist/backend/node_modules/.pnpm/@nestjs+passport@10.0.2_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1__owspyaltb3hygw66etzcv5nnwq/node_modules/@nestjs/passport/dist/passport/passport.strategy.js:32:13) Backend Server | at new JwtStrategy (/dist/backend/dist/auth/strategies/jwt.strategy.js:22:9) Backend Server | at Injector.instantiateClass (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:365:19) Backend Server | at callback (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:65:45) Backend Server | at async Injector.resolveConstructorParams (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:144:24) Backend Server | at async Injector.loadInstance (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:70:13) Backend Server | at async Injector.loadProvider (/dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/injector.js:97:9) Backend Server | at async /dist/backend/node_modules/.pnpm/@nestjs+core@10.2.7_@nestjs+common@10.2.7_class-transformer@0.5.1_class-validator@0.14.1_refl_i5vxtddbnp5qhu6jmywguprp3e/node_modules/@nestjs/core/injector/instance-loader.js:56:13 Backend Server | at async Promise.all (index 4) Exiting process because Backend Server exited with code 1 ` ### Steps to reproduce 1. use the env and docker compose 2. Start the application ### Environment Production ### Version Self-hosted

kerem

2026-03-16 21:12:35 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 21:12:51 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Oct 29, 2024):

Hi @crocofied
It looks like the container might not be able to read the JWT_SECRET from your .env file. Could you double-check by running these commands?

# Access the container's shell
docker exec -it <container_id> sh

# List all environment variables to check for JWT_SECRET
printenv

This should help confirm if the variable is being picked up correctly. Let me know how it goes.

@mirarifhasan commented on GitHub (Oct 29, 2024): Hi @crocofied It looks like the container might not be able to read the `JWT_SECRET` from your .env file. Could you double-check by running these commands? ```sh # Access the container's shell docker exec -it <container_id> sh # List all environment variables to check for JWT_SECRET printenv ``` This should help confirm if the variable is being picked up correctly. Let me know how it goes.

kerem commented

2026-03-16 21:12:56 +03:00

Author

Owner

@Leon-Luu commented on GitHub (Nov 8, 2024):

This issue doesn't needs to be executed on docker to reproduce. We are seeing same issue on local running:

go to /packages/hoppscotch-backend
pnpm start:dev

Error:
[Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key
[Nest] 39480 - 2024-11-08 09:34:57 LOG [InstanceLoader] ConfigModule dependencies initialized +7ms
[Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key
[Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key
TypeError: JwtStrategy requires a secret or key
TypeError: JwtStrategy requires a secret or key
at new JwtStrategy (F:\hoppscotch\node_modules.pnpm\passport-jwt@4.0.1\node_modules\passport-jwt\lib\strategy.js:45:15)
at new MixinStrategy (F:\hoppscotch\node_modules.pnpm@nestjs+passport@10.0.3_@nestjs+common@10.4.4_class-transformer@0.5.1_class-validator@0.14.1__del4tn2jophjss3wlonykp5veu\node_modules@nestjs\passport\dist\passport\passport.strategy.js:32:13)
at new JwtStrategy (F:\hoppscotch\packages\hoppscotch-backend\dist\auth\strategies\jwt.strategy.js:22:9)

@Leon-Luu commented on GitHub (Nov 8, 2024): This issue doesn't needs to be executed on docker to reproduce. We are seeing same issue on local running: 1) go to /packages/hoppscotch-backend 2) pnpm start:dev **Error:** [Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key [Nest] 39480 - 2024-11-08 09:34:57 LOG [InstanceLoader] ConfigModule dependencies initialized +7ms [Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key [Nest] 39480 - 2024-11-08 09:34:57 ERROR [ExceptionHandler] JwtStrategy requires a secret or key TypeError: JwtStrategy requires a secret or key TypeError: JwtStrategy requires a secret or key at new JwtStrategy (F:\hoppscotch\node_modules\.pnpm\passport-jwt@4.0.1\node_modules\passport-jwt\lib\strategy.js:45:15) at new MixinStrategy (F:\hoppscotch\node_modules\.pnpm\@nestjs+passport@10.0.3_@nestjs+common@10.4.4_class-transformer@0.5.1_class-validator@0.14.1__del4tn2jophjss3wlonykp5veu\node_modules\@nestjs\passport\dist\passport\passport.strategy.js:32:13) at new JwtStrategy (F:\hoppscotch\packages\hoppscotch-backend\dist\auth\strategies\jwt.strategy.js:22:9)

kerem commented

2026-03-16 21:13:01 +03:00

Author

Owner

@mirarifhasan commented on GitHub (Nov 29, 2024):

Hi @crocofied
If you’re still experiencing the issue, please don’t hesitate to let us know—we’re here to help! If everything is working fine now, we’ll go ahead and close this issue.

Looking forward to your update!

@mirarifhasan commented on GitHub (Nov 29, 2024): Hi @crocofied If you’re still experiencing the issue, please don’t hesitate to let us know—we’re here to help! If everything is working fine now, we’ll go ahead and close this issue. Looking forward to your update!

kerem commented

2026-03-16 21:13:06 +03:00

Author

Owner

@mihalcea-bogdan-daniel commented on GitHub (Feb 21, 2025):

This is still an issue. Running pnpm start:dev in package/hoppscotch-backend

@mihalcea-bogdan-daniel commented on GitHub (Feb 21, 2025): This is still an issue. Running `pnpm start:dev` in package/hoppscotch-backend

kerem commented

2026-03-16 21:13:11 +03:00

Author

Owner

@mihalcea-bogdan-daniel commented on GitHub (Feb 21, 2025):

@Leon-Luu
In the app.module.ts at line 39 add the following:
envFilePath: '../../.env.example'

This will load the correct environment file.

@mihalcea-bogdan-daniel commented on GitHub (Feb 21, 2025): @Leon-Luu In the [app.module.ts](https://github.com/hoppscotch/hoppscotch/blob/35a471f1208e54433a0c8967d99257e92bc32e5a/packages/hoppscotch-backend/src/app.module.ts#L38) at line 39 add the following: `envFilePath: '../../.env.example'` This will load the correct environment file.

kerem commented

2026-03-16 21:13:16 +03:00

Author

Owner

@ferdousulhaque commented on GitHub (May 18, 2025):

Need help on how to resolve this over the Kubernetes deployment file. Here is my config:

while deployment, I am only using the image

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hoppscotch
  labels:
    app: hoppscotch
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hoppscotch
  template:
    metadata:
      labels:
        app: hoppscotch
    spec:
      containers:
        - name: hoppscotch
          image: hoppscotch/hoppscotch:latest
          ports:
            - containerPort: 3000
          resources:
            limits:
              cpu: 500m
              memory: 256Mi
            requests:
              cpu: 100m
              memory: 128Mi
          env:
            - name: NODE_ENV
              value: "production"

@ferdousulhaque commented on GitHub (May 18, 2025): Need help on how to resolve this over the Kubernetes deployment file. Here is my config: while deployment, I am only using the image ``` apiVersion: apps/v1 kind: Deployment metadata: name: hoppscotch labels: app: hoppscotch spec: replicas: 1 selector: matchLabels: app: hoppscotch template: metadata: labels: app: hoppscotch spec: containers: - name: hoppscotch image: hoppscotch/hoppscotch:latest ports: - containerPort: 3000 resources: limits: cpu: 500m memory: 256Mi requests: cpu: 100m memory: 128Mi env: - name: NODE_ENV value: "production" ```

kerem commented

2026-03-16 21:13:22 +03:00

Author

Owner

@syorito-hatsuki commented on GitHub (Jul 22, 2025):

Ye. That not answer how fix it on K8S

@syorito-hatsuki commented on GitHub (Jul 22, 2025): Ye. That not answer how fix it on K8S

kerem commented

2026-03-16 21:13:27 +03:00

Author

Owner

@blevkovych commented on GitHub (Jul 30, 2025):

I was just following the installation process and see the same issue in logs for backend container.

@blevkovych commented on GitHub (Jul 30, 2025): I was just following the [installation process](https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build) and see the same issue in logs for backend container.

kerem referenced this issue

2026-03-17 01:03:10 +03:00

[PR #1641] [MERGED] Teams β #3440