fix: outdated/wrong algorithm argument passed to jsonwebtoken #907
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@vonage/jwt VerifySignature defaults to RS256.
My best guess is that it's to accommodate a previous version of the authentication/authorization setup vonage had.
Either way, there is no reason for it, as JWTs contain the algorithm in the header.
Additionally, the JWTs I receive from Vonage are HS256. Meaning that this is breaking and verifyToken does not work.
There is another question as to wether this should be provided by the Vonage SDK, but that's up to you guys!
Description
Removed RS256 argument passed to verify function from jsonwebtoken.
Motivation and Context
My webhooks recieve HS256 tokens, not RS256 from Vonage. Either way it shouldn't be defaulted as the algorithm is contained in the JWT header.
Testing Details
No test run done, should pass though.
--
--
Example Output or Screenshots (if appropriate)
Types of changes
Checklist