3 ms·

You mean the public key? The private key is what's used to sign tokens, the public key is used to verify the signature and can be freely shared. Or maybe you me

by Salgat 4y ago

You mean the public key? The private key is what's used to sign tokens, the public key is used to verify the signature and can be freely shared. Or maybe you mean they used a symmetric key and shared that?

ehutch79 4y ago
I'm pretty sure he meant they were putting the private key in the jwt. People do some dumb stuff. And the dunning kruger effect is all too real.
- Salgat 4y ago
  He said it was used to verify the token, which is only true if you use a symmetric key not a private key.
  - ehutch79 4y ago
    Right, from what they're saying, they're pulling the key out of the claims to verify the token. No it doesn't make sense.
xtracto 4y ago
Private key to SIGN the content.
- P5fRxh5kUvp2th 4y ago
  what am I missing? a JWT signature is the header and payload encrypted and attached. You would do that encryption via a private key, said public key would be used to verify it was encrypted by the private key. What does "to SIGN" mean in this context?