Why not HMAC?

[JonasSchweigler]

Why are you are not using HMAC? Is there a particular reason.

[BRAVO68WEB]

HI @JonasSchweigler ,

Using HMAC type Keys for JWTs makes them vulnerable and easy to manipulate as its just base64 encryption.

Testing it out ...

• Generate a JWT like eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Payload here -

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

• Now I manipulated the Payload a bit
  eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODEyMzEyMyIsIm5hbWUiOiJKb2huIERvZSIsImlhdCI6MTUxNjIzOTAyMn0.ZVySjZDGuGci28UgGDSorzrkxcnHWBeC5DGevLNLj-E

Payload here -

{
  "sub": "12345678123123",
  "name": "John Doe",
  "iat": 1516239022
}

• Now If you use this token, it will also work for validation.

So We should use RSA type Keys for generating JWT keys which are more secure.

Hope I answered your query.

[JonasSchweigler]

thx 😇