Read the signing key from the environment and name the algorithm

azer commented

2026-09-16 08:17:05 +00:00

Owner

This repository exists to be copied, so the two things worth getting right are the two that get copied: the signing key was a literal in index.js, and jwt.verify named no algorithm. The key now comes from JWT_SECRET with a fallback called insecure-development-key so the sample still runs out of the box and nobody mistakes the value for one to keep; sign and verify both name HS256. Checked by running it: login returns a token, /protected accepts it, a garbage token and wrong credentials are both 401.

azer added 1 commit

2026-09-16 08:17:06 +00:00

Read the signing key from the environment and name the algorithm 97fa9581de

A sample that people copy should not carry a key in the file they copy, and a
verifier should say which algorithm it accepts rather than take the token's
word for it. The fallback key keeps the sample runnable and is named so that
nobody keeps it.

azer merged commit eda179e6db into master

2026-09-16 15:39:47 +00:00

azer referenced this pull request from a commit

2026-09-16 15:39:47 +00:00

Merge pull request 'Read the signing key from the environment and name the algorithm' (#1) from azer/jwt-key-and-algorithm into master

Rows
Columns

Read the signing key from the environment and name the algorithm #1