Make 'alg' JWT header's parameter follow the config

softwaremill / akka-http-session

Web & mobile client-side akka-http sessions, with optional JWT support

https://softwaremill.com/open-source/

Apache License 2.0

440 stars 58 forks source link

Make 'alg' JWT header's parameter follow the config #68

Closed mkubala closed 5 years ago

mkubala commented 5 years ago

This PR fixes a bug with issuing JWT tokens with alg header always set to HS256 (regardless of the currently applied configuration).

Since our library does not care about the header's alg value when checking Json Web Signatures, this issue did not appear as long as you either stay with HS256 algorithm or do not perform any JWS verification outside of your app.