github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-19 12:28:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7325] feat(jwt): add HS256 symmetric key algorithm support #15476

New Issue
Open
opened 2026-04-13 10:02:58 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:02:58 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7325
Author: @Bekacru
Created: 1/13/2026
Status: 🔄 Open

Base: next ← Head: claude/slack-update-stripe-docs-consistency-8Sc0w

📝 Commits (1)

  • 5370d03 feat(jwt): add HS256 symmetric key algorithm support

📊 Changes

5 files changed (+221 additions, -5 deletions)

View changed files

📝 packages/better-auth/src/plugins/jwt/index.ts (+5 -0)
📝 packages/better-auth/src/plugins/jwt/jwt.test.ts (+165 -0)
📝 packages/better-auth/src/plugins/jwt/types.ts (+12 -2)
📝 packages/better-auth/src/plugins/jwt/utils.ts (+16 -1)
📝 packages/better-auth/src/plugins/jwt/verify.ts (+23 -2)

📄 Description

Adds support for HS256 (HMAC with SHA-256) symmetric key signing to the JWT plugin. This enables users to use symmetric key JWTs for internal service-to-service communication.

Changes:

  • Add HS256 to JWKOptions type
  • Generate symmetric secret keys for HS256 using jose's generateSecret
  • Handle HS256 signing with the secret key
  • Handle HS256 verification using the secret key (with decryption)
  • Disable JWKS endpoint for HS256 (symmetric keys should not be exposed)
  • Add comprehensive tests for HS256 functionality

Closes #7245

Summary by cubic

Added HS256 (HMAC-SHA256) support to the JWT plugin for symmetric key signing and verification. Meets #7245 by enabling symmetric service-to-service JWTs and disabling the JWKS endpoint for HS256.

  • New Features
    • HS256 added to JWKOptions; symmetric secret generated via jose.generateSecret.
    • Sign and verify with the shared secret; works with or without private key encryption.
    • JWKS endpoint returns 404 for HS256 to avoid exposing symmetric keys.
    • Comprehensive tests cover key generation, signing, session tokens, and verification.

Written for commit c813a69cbfb974c03f74c9a0fac9ee1e407c15a3. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7325 **Author:** [@Bekacru](https://github.com/Bekacru) **Created:** 1/13/2026 **Status:** 🔄 Open **Base:** `next` ← **Head:** `claude/slack-update-stripe-docs-consistency-8Sc0w` --- ### 📝 Commits (1) - [`5370d03`](https://github.com/better-auth/better-auth/commit/5370d0367cf8614508c0e3914eae1a813218fe0a) feat(jwt): add HS256 symmetric key algorithm support ### 📊 Changes **5 files changed** (+221 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/jwt/index.ts` (+5 -0) 📝 `packages/better-auth/src/plugins/jwt/jwt.test.ts` (+165 -0) 📝 `packages/better-auth/src/plugins/jwt/types.ts` (+12 -2) 📝 `packages/better-auth/src/plugins/jwt/utils.ts` (+16 -1) 📝 `packages/better-auth/src/plugins/jwt/verify.ts` (+23 -2) </details> ### 📄 Description Adds support for HS256 (HMAC with SHA-256) symmetric key signing to the JWT plugin. This enables users to use symmetric key JWTs for internal service-to-service communication. Changes: - Add HS256 to JWKOptions type - Generate symmetric secret keys for HS256 using jose's generateSecret - Handle HS256 signing with the secret key - Handle HS256 verification using the secret key (with decryption) - Disable JWKS endpoint for HS256 (symmetric keys should not be exposed) - Add comprehensive tests for HS256 functionality Closes #7245 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Added HS256 (HMAC-SHA256) support to the JWT plugin for symmetric key signing and verification. Meets #7245 by enabling symmetric service-to-service JWTs and disabling the JWKS endpoint for HS256. - **New Features** - HS256 added to JWKOptions; symmetric secret generated via jose.generateSecret. - Sign and verify with the shared secret; works with or without private key encryption. - JWKS endpoint returns 404 for HS256 to avoid exposing symmetric keys. - Comprehensive tests cover key generation, signing, session tokens, and verification. <sup>Written for commit c813a69cbfb974c03f74c9a0fac9ee1e407c15a3. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:02:58 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15476