3 ms·
But my code can just ignore the alg passed by the user and use whatever one I want to use.
by lxe 9y ago
But my code can just ignore the alg passed by the user and use whatever one I want to use.
- lvh 9y agoIf you're going to ignore compatibility anyway, you could also use good crypto. The JWT doesn't define what "Recommended" and "Recommended+" means but apparently RSA+PKCSv15 is Recommended+ so I guess it means "crypto known to be broken in the 90s".