Custom JWT Public Key Config is confusing / error prone

[mgeerling]

Low priority:

I've had two users hit issues when configuring JWT auth recently.

let jwtProvider = new auth.JwtAuthProvider(
  {
    publicKey: '-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhki...\n-----END PUBLIC KEY-----'
  }
)

Wouldn't it be simpler to just have the string be the public key rather than also having -----BEGIN PUBLIC KEY-----\n

Have had people do things like wrong number of -, etc

[nirinchev]

I think it's possible to have a public key that has different headers - e.g. -----BEGIN RSA PUBLIC KEY-----. When they generate the public key, the file should contain the headers and they must be copied as-is, so not sure why they were inputing them manually. I'm not a crypto expert, so it's possible I'm missing something though.

[mgeerling]

oh interesting -- so you're saying that the entirety of the public key is copied into the field as a string? I was under the impression that a portion of it was copied after the \n but it sounds like this was my misunderstanding

[nirinchev]

The \n-s were added just as a hint to people that they need to make sure to preserve newlines. Public keys usually look like:

-----BEGIN PUBLIC KEY-----
fdafdafdaasd
fdafdaefadsf
dfafdafdfdfd
...
-----END PUBLIC KEY-----

And if people just copy the entire contents of the file and paste it, it will span multiple lines in js (making the string invalid), so it's only natural to manually concatenate it. But I thought it may not be obvious that when concatenating, you should make sure to preserve the newlines, which is why I added the \n characters. If you have suggestions on how to make it clearer/easier to follow, I'd be happy to change it a bit.

[mgeerling]

Added a small clarifying example per your notes.
Closing out