How do I encrypt JWT (HS256) with secret in version 3

[tombrouwer]

Hi,

First, thanks to all the hard work!

Before in version 2 I used the following to encrypt with HS256:

JWT.sign(this.getPayload(), this.tokenSecret, {
      algorithm: this.algorithm,
      expiresIn: this.tokenTtl,
});

Where tokenSecret is a string, algorithm is "HS256" (string type) en tokenTtl is "60m" (string type). Now I have updated the package to version 3.

When I try:

new SignJWT(this.getPayload())
      .setProtectedHeader({ alg: this.algorithm })
      .setIssuedAt()
      .setIssuer("urn:example:issuer")
      .setAudience("urn:example:audience")
      .setExpirationTime(String(this.tokenTtl))
      .sign(crypto.createSecretKey(this.tokenSecret));

Typescript will tell me that tokenSecret (string) is not assignable to "ArrayBufferView". Can there be a simple example with signing with a secret key (string)?

Thanks in advance!

[panva]

How do I encrypt JWT (HS256) with secret in version 3

Please understand that SIGNING a JWT does not mean it's encrypted.

Typescript will tell me that tokenSecret (string) is not assignable to "ArrayBufferView"

Rightfully so. Even without asking for a stack i can tell the problem is not with the types of this lib, but rather how you call node's crypto.createSecretKey. It does not take string as an argument for key material, the same way this lib doesn't. Inspecting the stack you get from tsc will confirm that.

Can there be a simple example with signing with a secret key (string)?

Strings make terrible secrets, because they're assuming a readable encoding. I will not be opening the API to string key material inputs anymore.

.sign also takes a Uint8Array for symmetric algorithms, in which case all you have to do is pass Buffer.from(secretString).

[grubshka]

To simply sign a JWT from a string secret, I used this code :

      const token = await new jose.SignJWT({ key: "value" })
        .setProtectedHeader({ alg: "HS256" })
        .sign(new TextEncoder().encode(SECRET_STRING))

[dtinth]

You have to tell createSecretKey that the input is a UTF-8 encoded string.

So, instead of:

crypto.createSecretKey(this.tokenSecret)
//                     ^ Argument of type 'string' is not assignable
//                       to parameter of type 'ArrayBufferView'

…do this:

crypto.createSecretKey(this.tokenSecret, 'utf-8')