Node-jwks-rsa: expressJwtSecret: why is it called "secret"?

cretaceousflower · June 20, 2022, 3:53am

Hi.
I am unclear re the expressJwtSecret() secret provider generator. If it’s role is to retrieve a public key - why is it called “secret”? Is there some handling of secrets that I am missing?
Thanks!

dan.woda · June 27, 2022, 5:05pm

Hi @cretaceousflower,

Welcome to the Auth0 Community!

In the case where you are using a public key, it is not actually a secret, and it appears to simply be a naming decision. Here is an example where they are using the public key as the variable for secret:

github.com

auth0/express-jwt/blob/master/README.md?plain=1#L116


      
          );
          ```
          
          
This is especially useful when applying to multiple routes. In the example above, `path` can be a string, a regexp, or an array of any of those.
          
          
> For more details on the `.unless` syntax including additional options, please see [express-unless](https://github.com/jfromaniello/express-unless).
          
          
This module also support tokens signed with public/private key pairs. Instead of a secret, you can specify a Buffer with the public key
          
          
```javascript
          var publicKey = fs.readFileSync("/path/to/public.pub");
          jwt({ secret: publicKey, algorithms: ["RS256"] });
          ```
          
          
### Customizing Token Location
          
          
A custom function for extracting the token from a request can be specified with
          the `getToken` option. This is useful if you need to pass the token through a
          query parameter or a cookie. You can throw an error in this function and it will
          be handled by `express-jwt`.

Topic		Replies	Views
How to generate secret key programmatically via auth0 jwt? Help configuration , application	3	1652	April 14, 2023
How can I get this JWT Secret Key JWT.io jwt , login , access-token , private-key	2	3331	January 11, 2024
Issue validating a token with express-jwt Help lock , express-jwt	8	22642	March 2, 2018
Should I be validating JWT on my back-end with or without secret? Help login-experience , new-universal-login-experience	6	2521	May 19, 2023
Which sectet do I need to verify the jwt in NodeJS? Help login-experience , new-universal-login-experience	2	1425	February 4, 2023

Node-jwks-rsa: expressJwtSecret: why is it called "secret"?

Related Topics