# Express-openid-connect: unexpected JWT alg received, expected HS256, got: RS256

**URL:** <https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700>\
**Category:** Get Help\
**Created:** [July 26, 2022, 8:14pm UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700 "2022-07-26T20:14:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lissett.diaz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lissett.diaz/32/26496_2.png) [@lissett.diaz](https://community.auth0.com/u/lissett.diaz)\
**Post date:** [July 26, 2022, 8:14pm UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/1 "2022-07-26T20:14:31Z")

</div>

I am trying to use `express-openid-connect: 2.7.3` with HSHS256 signing algorithm. I am getting this error:

```auto
BadRequestError: unexpected JWT alg received, expected HS256, got: RS256
    at /node_modules/express-openid-connect/middleware/auth.js:121:19

```

I have this config:

server.js

```auto
app.use(
    auth({
      authRequired: true,
      idpLogout: true,
      idTokenSigningAlg: 'HS256',
      issuerBaseURL: process.env.ISSUER_BASE_URL,
      clientID: process.env.CLIENT_ID,
      authorizationParams: {
        response_type: "code",
        audience: process.env.AUDIENCE,
        scope: "openid profile email",
      },
    })
  );

```

.env

```auto
CLIENT_ID=Kr *********************** WhTI
BASE_URL=http://localhost:3000
CLIENT_SECRET=wd ************************************************ tRLg99
AUDIENCE=https://my-audience
SECRET=0y ************************ ySlx
ISSUER_BASE_URL=https://mydomain.auth0.com
PORT=3000

```

What I am missing?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 26, 2022, 9:47pm UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/3 "2022-07-26T21:47:22Z")

</div>

Hello @lissett.diaz welcome to the community!

> [@lissett.diaz](#):
>
> What I am missing?

There could be several things going on - First, can you verify that you have updated the signing algorithm in the application settings? You can do so by navigating to the application (client\_id) in your Auth0 dashboard → Advanced → OAuth.

What type of app is the application (web, SPA, etc.)?

Let us know!

---

<div class="post-metadata">

**Author:** ![lissett.diaz](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/lissett.diaz/32/26496_2.png) [@lissett.diaz](https://community.auth0.com/u/lissett.diaz)\
**Post date:** [July 26, 2022, 10:36pm UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/4 "2022-07-26T22:36:54Z")

</div>

Hi @ty.frith thank for answering.

This is what I have:

 ![Screen Shot 2022-07-26 at 18.13.50](https://global.discourse-cdn.com/auth0/original/3X/a/8/a839f22e6e3274c6995e53364d112a6f89958a1d.png)

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 26, 2022, 11:44pm UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/5 "2022-07-26T23:44:04Z")

</div>

Thanks for confirming! Strange as I’m unable to reproduce on my end currently 🤔 I did notice that your client id is that of a SPA application, what happens if you create a Web App in Auth0 and use that instead here?

If you are using an API registered in Auth0 you will need to have the algorithm set to HS256 there as well.

Additionally, you may want to consider using RS256 if possible:

> **[RS256 vs HS256 What's the difference?](https://auth0.com/blog/rs256-vs-hs256-whats-the-difference/)**
>
> Learn the difference between RS256 and HS256 JWT signing algorithms

> [@JWT signing algorithms RS256 vs HS256](https://community.auth0.com/t/jwt-signing-algorithms-rs256-vs-hs256/7720):
>
> Are there any requirements/recommendations/best practices for choosing one over the other? Thank you.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [July 28, 2022, 12:45am UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/7 "2022-07-28T00:45:12Z")

</div>

Resolved in another thread - Application needs to be set to Web Application in Auth0 Dashboard settings.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [August 12, 2022, 12:45am UTC](https://community.auth0.com/t/express-openid-connect-unexpected-jwt-alg-received-expected-hs256-got-rs256/87700/8 "2022-08-12T00:45:48Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.