S6781 Reports static key for encryption false positive

Rules and Languages Report False-positive / False-negative...
1

  • What language is this for? C#

  • Which rule? S6781

  • Why do you believe it’s a false-positive/false-negative?
    Says: JWT secret keys should not be disclosed when we initialize with key generated from token fetched from Azure KeyVault. See below

  • Are you using

    • SonarQube Cloud? Server
    • SonarQube Server / Community Build - which version? 2026-lta, recently upgraded to it.

  • How can we reproduce the problem? Give us a self-contained snippet of code (formatted text, no screenshots)

SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.Sha256)

The “key” is a value fetched from Azure KeyVault.

2

This is temporary code and not deployed to production much like the comment here says.

[HttpPost]
public IActionResult GenerateToken([FromBody] TokenGenerationRequest request)
{
// TODO: When new API deploys this needs to be much more secure before it can be used in production.
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.UTF8.GetBytes(TokenSecret);

 var claims = new List<Claim>
 {
     new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
     new(JwtRegisteredClaimNames.Sub, "something"),
 };

 var tokenDescriptor = new SecurityTokenDescriptor
 {
     Subject = new ClaimsIdentity(claims),
     Expires = DateTime.UtcNow.Add(TokenLifeTime),
     Issuer = "https://...",
     Audience = "https://...",
     SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.Sha256)
 };

 var token = tokenHandler.CreateToken(tokenDescriptor);
 var jwt = tokenHandler.WriteToken(token);

 return Ok(jwt);

}