jwt token generation improvement (#557)

* add some warning comment for those who want to choose their secret
* strictly follow the golang doc for using crypto/rand
* fatal if not enough entropy
* add a check when using pre-choosen secret

pkg/apiserver/middlewares/v1/jwt.go

@@ -147,19 +147,23 @@ func NewJWT(dbClient *database.Client) (*JWT, error) {
 		secret []byte
 	)
 
+	//Please be aware that brute force HS256 is possible.
+	//PLEASE choose a STRONG secret
 	secret_string := os.Getenv("CS_LAPI_SECRET")
-
 	if secret_string == "" {
-		secret = make([]byte, 8)
-		if n, err := rand.Reader.Read(secret); err != nil {
-			log.Fatalf("Unable to generate a new random seed for JWT generation")
+		secret = make([]byte, 64)
+		if n, err := rand.Read(secret); err != nil {
+			log.Fatalf("unable to generate a new random seed for JWT generation")
 		} else {
-			if n != 8 {
-				log.Errorf("Not enough entropy at random seed generation for JWT generation")
+			if n != 64 {
+				log.Fatalf("not enough entropy at random seed generation for JWT generation")
 			}
 		}
 	} else {
 		secret = []byte(secret_string)
+		if len(secret) < 64 {
+			log.Fatalf("secret not strong enough")
+		}
 	}
 
 	jwtMiddleware := &JWT{