I got the task to create unsigned JWTs, which is possible by setting the alg value to none
and omitting the third part, the signature of the JWT (see Create JWT token without signature?)
I struggle creating such tokens with npm jose; here is my code example:
const jose = require('jose')
const secret = new TextEncoder().encode(
'verysecret',
)
const alg = 'none'
async function getJwt() {
const jwt = await new jose.SignJWT({ 'demo': 'unsigned JWT' })
.setProtectedHeader({ alg })
.sign(secret)
console.log(jwt)
}
getJwt()
Here, I get TypeError: Key for the none algorithm must be one of type KeyObject or CryptoKey. Received an instance of Uint8Array
, while if I remove the signing bit, the returned object is not a JWT:
SignJWT {
_payload: { demo: 'unsigned JWT', iat: 1719452906 },
_protectedHeader: { alg: 'none' }
}
Changing the algorithm to a valid value such as HS256
returns a beautiful JWT, but it would be signed, and I need an unsigned one.