github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-23 03:24:51 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8923] Support asymmetric jwt for session cookies #19869

New Issue
Open
opened 2026-04-15 19:13:35 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-15 19:13:35 -05:00
Owner
Copy Link
Copy Source

Originally created by @wallzero on GitHub (Apr 2, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8923

Originally assigned to: @ping-maxwell on GitHub.

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

This comment suggest asymmetric keys for jwt session cookies are unsupported.

I discovered this after trying to verify the JWT session cookie using the JWKS keys.

Describe the solution you'd like

I'd like an option to generate jwt session cookies with asymmetric keys. I understand there are tradeoffs but it would also be more secure to share public keys among my services instead of secrets. Also the JWKS end point is easier to use than sharing secrets.

Describe alternatives you've considered

For now one can continue using secrets for jwt session cookies.

Additional context

I was following the JWKS example and I could not get the JWKS example to work. After trying to verify with jwt from the session cookie, jose it throws this error: Unsupported "alg" value for a JSON Web Key Set. I now know this is because the session cookies are using secrets and not using asymmetric keys.

Alternatively, I tried with hono/jwt and jwtVerify and I recieve the error JwtHeaderRequiresKid: required "kid" in jwt header: {"alg":"HS256"}. This makes sense now that I know the jwt session cookie does not use asymmetric keys.

It'd be helpful if the documentation made this distinction for now.

Originally created by @wallzero on GitHub (Apr 2, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8923 Originally assigned to: @ping-maxwell on GitHub. ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. [This comment suggest](https://github.com/better-auth/better-auth/discussions/7672#discussioncomment-15635068) asymmetric keys for jwt session cookies are unsupported. I discovered this after trying to verify the JWT session cookie using the JWKS keys. ### Describe the solution you'd like I'd like an option to generate jwt session cookies with asymmetric keys. I understand there are tradeoffs but it would also be more secure to share public keys among my services instead of secrets. Also the JWKS end point is easier to use than sharing secrets. ### Describe alternatives you've considered For now one can continue using secrets for jwt session cookies. ### Additional context [I was following the JWKS example](https://better-auth.com/docs/plugins/jwt#example-with-local-jwks) and I could not get the JWKS example to work. After trying to verify with jwt from the session cookie, `jose` it throws this error: `Unsupported "alg" value for a JSON Web Key Set`. I now know this is because the session cookies are using secrets and not using asymmetric keys. Alternatively, I tried with `hono/jwt` and `jwtVerify` and I recieve the error `JwtHeaderRequiresKid: required "kid" in jwt header: {"alg":"HS256"}`. This makes sense now that I know the jwt session cookie does not use asymmetric keys. It'd be helpful if the documentation made this distinction for now.
GiteaMirror added the securityenhancement labels 2026-04-15 19:13:35 -05:00
GiteaMirror commented 2026-04-15 19:13:37 -05:00
Author
Owner
Copy Link
Copy Source

@GautamBytes commented on GitHub (Apr 3, 2026):

Will be working on it!

<!-- gh-comment-id:4183196606 --> @GautamBytes commented on GitHub (Apr 3, 2026): Will be working on it!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels enhancement security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19869