4 ms·
If you sign a JWT with the 5 character secret does it generate a token that you can verify with the 64 character secret? I'm wondering if it could be a key coll
by porpoisemonkey 10y ago
If you sign a JWT with the 5 character secret does it generate a token that you can verify with the 64 character secret? I'm wondering if it could be a key collision.
- scandox 10y agoI couldn't no. Made sure I was using everything the same, but I couldn't determine any relationship between original secret and one produced by program. However contrary to my original statement it turned out secret in use was actually only 30 characters long. I've passed on more detailed info to OP.
- porpoisemonkey 10y agoThanks for checking. > However contrary to my original statement it turned out secret in use was actually only 30 characters long. I'm guessing it's 32 characters long? (256 bits) That matches to the spec and is a good key - as referenced in other threads anything longer is mostly a waste as the key input gets hashed down to a fixed size.