Add clear warnings for HS256 secret length about jwt HOT 6 CLOSED

Will take care to add it to the README this week (now leaving till Friday)

from jwt.

Hi @lil5 very good point, will take care of it. Also feel free to PR if you want to 😉

from jwt.

If this is not a PR of this projects scope I guess a warning on the readme would be good.

Maybe something like:

⚠️ Create a key for HS256 of at least 256 bits!
the RFC7518 standard states that "A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm."

tldr; Create your key for HS256 of 32 bytes (256 bits) long using crypto/random

from jwt.

@cristaloleg reminder 😉

from jwt.

Ouch...

from jwt.

Done and v4 finally released. I'm really sorry for the delay but shit happens.

from jwt.