pilcrowonpaper / oslo Goto Github PK

can you export the constant time equal function that you use in scrypt password util? :)

Currently, the createJWT method only accepts the key as an ArrayBuffer. This is probably because many methods in oslo/crypto only accept an ArrayBuffer. However, the Web Crypto API often accepts TypedArray (eg. Uint8Array) and DataView as well.

My personal use-case is that I am using JWTs in cookie sessions. Instead of generating the JWT key at runtime, I want to save the JWT key as a string, so the sessions are valid even when I restart the server.

In any case, ArrayBuffer is harder to create/manipulate than Uint8Array.

Because the Web Crypto API is compatible either way, this shouldn't require any changes in logic (just type-defs).

PS: Thanks so much for your work here and with lucia. It means I have one less thing to worry about when implementing authentication.

Upon reviewing the oslo module, I've found its features compelling and plan on integrating it into our production applications. However, I've noticed an inconsistency concerning the oslo/jwt not completely adhering to the JWT spec.

According to Section 4.1.3 of the spec, the aud claim should usually be an array of strings, although it can also be just a string.

Looking your library's source code, I noticed that it only supports string as the type of audience. Can you confirm if this was an intentional design decision?

If not, I am happy to contribute by making a PR to resolve this issue.