search

michelp / pgjwt

PostgreSQL implementation of JWT (JSON Web Tokens)
MIT License
368 stars 60 forks source link

pgjwt should support asymmetric/RSA private key signing #13

Closed raphet closed 2 years ago

raphet commented 4 years ago

See https://security.stackexchange.com/a/234018

Having multiple services accessing a public key for signage verification - with postgres as authority server is a safer situation than distributing the secret HMAC key on every services.

Therefore I am suggesting to include into the pgjwt module a way to support creating JWT using a private RSA key within postgres. That way, login/authentication via postgrest would be possible and third party services would only need to know the public key to verify any jwt token's origin/legitimacy.

michelp commented 2 years ago

Unfortunately pgcrypto does not support public key signing.