github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #390] Support for HS256 algorithm for JWT #8247

New Issue
Closed
opened 2026-04-13 03:20:18 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-13 03:20:18 -05:00
Owner
Copy Link

Originally created by @dvalbuena1 on GitHub (Nov 2, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/390

I would like to request support for HS256, the most common symmetric algorithm.

In my case my infrastructure shares resources with backend and frontend, and it would be ideal to use a single shared key with rotation. As for the implementation, it would probably be straightforward, since even the endpoint to get the public key wouldn't be necessary anymore.

Looking forward to any comments about this.

Originally created by @dvalbuena1 on GitHub (Nov 2, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/390 I would like to request support for HS256, the most common symmetric algorithm. In my case my infrastructure shares resources with backend and frontend, and it would be ideal to use a single shared key with rotation. As for the implementation, it would probably be straightforward, since even the endpoint to get the public key wouldn't be necessary anymore. Looking forward to any comments about this.
GiteaMirror added the locked label 2026-04-13 03:20:18 -05:00
GiteaMirror commented 2026-04-13 03:20:19 -05:00
Author
Owner
Copy Link

@svaraborut commented on GitHub (Nov 5, 2024):

Can you please better describe the issue? How can you share a symmetric key between the frontend and the backend?

<!-- gh-comment-id:2457810068 --> @svaraborut commented on GitHub (Nov 5, 2024): Can you please better describe the issue? How can you share a symmetric key between the frontend and the backend?
GiteaMirror commented 2026-04-13 03:20:20 -05:00
Author
Owner
Copy Link

@dvalbuena1 commented on GitHub (Nov 5, 2024):

I am using SST with Next.js so my Backend and Frontend are in AWS. A way to share the key would be by using NEXT_PUBLIC env variables to share it to the client so the JWT can be signed. And since the private key resides in AWS I can use it on my API Gateway to validate the JWT. Probably the only downside is that I would have to deploy my Frontend every time my key is rotated.

Another approach I was thinking about recently is to check the Session on my API Gateway instead of using JWT. But this will need a DB request which would be nice to be able to avoid that.

I am not an expert so let me know what you think about this approach and if it makes sense, if not I'll be happy if you can give me any advice.

<!-- gh-comment-id:2458408601 --> @dvalbuena1 commented on GitHub (Nov 5, 2024): I am using SST with Next.js so my Backend and Frontend are in AWS. A way to share the key would be by using NEXT_PUBLIC env variables to share it to the client so the JWT can be signed. And since the private key resides in AWS I can use it on my API Gateway to validate the JWT. Probably the only downside is that I would have to deploy my Frontend every time my key is rotated. Another approach I was thinking about recently is to check the Session on my API Gateway instead of using JWT. But this will need a DB request which would be nice to be able to avoid that. I am not an expert so let me know what you think about this approach and if it makes sense, if not I'll be happy if you can give me any advice.
GiteaMirror commented 2026-04-13 03:20:20 -05:00
Author
Owner
Copy Link

@svaraborut commented on GitHub (Nov 6, 2024):

Still not clear to me. HS256 is a symmetric algorithm so if you send the key to the frontend you are defeating the purpose of the signature itself.

Symmetric cryptography can be used when the key is kept secret on the server. Better Auth already does that with the session cookie signature. The sole purpose of the jwt plugin is to allow for other servers to validate the jwt by retrieving the public key via a request to the jwks.

What is your usecase?

<!-- gh-comment-id:2458439327 --> @svaraborut commented on GitHub (Nov 6, 2024): Still not clear to me. HS256 is a symmetric algorithm so if you send the key to the frontend you are defeating the purpose of the signature itself. Symmetric cryptography can be used when the key is kept secret on the server. Better Auth already does that with the session cookie signature. The sole purpose of the jwt plugin is to allow for other servers to validate the jwt by retrieving the public key via a request to the jwks. What is your usecase?
GiteaMirror commented 2026-04-13 03:20:21 -05:00
Author
Owner
Copy Link

@dvalbuena1 commented on GitHub (Nov 6, 2024):

Sorry you are right, the part of sharing the key to the client doesn't make sense. In that case would be enough to store the key as a regular env variable so it'd life on the Next.js server securely. That said, Better Auth could sign the JWT with the symmetric key and from the API Gateway validate the JWT without the need to retrieve the public key doing a request. In that way I'd avoid to do a request to the internet and instead retrieve the key from Secrets Manager or something similar on AWS.

Not sure if my idea is not good or not a common practice, and may be it is just better to stick with the asymmetric key or validate the session. Please let me know.

<!-- gh-comment-id:2458504754 --> @dvalbuena1 commented on GitHub (Nov 6, 2024): Sorry you are right, the part of sharing the key to the client doesn't make sense. In that case would be enough to store the key as a regular env variable so it'd life on the Next.js server securely. That said, Better Auth could sign the JWT with the symmetric key and from the API Gateway validate the JWT without the need to retrieve the public key doing a request. In that way I'd avoid to do a request to the internet and instead retrieve the key from Secrets Manager or something similar on AWS. Not sure if my idea is not good or not a common practice, and may be it is just better to stick with the asymmetric key or validate the session. Please let me know.
GiteaMirror commented 2026-04-13 03:20:21 -05:00
Author
Owner
Copy Link

@svaraborut commented on GitHub (Nov 6, 2024):

It is a good idea. Symmetric cryptography makes sense as long as we make it possible to provide a static key to the plugin.

This is a feature request, and we would need some time to process it. Meanwhile you can create your own plugin, or feel free to contribute to this repo by extending the jwt plugin 😉

<!-- gh-comment-id:2460335998 --> @svaraborut commented on GitHub (Nov 6, 2024): It is a good idea. Symmetric cryptography makes sense as long as we make it possible to provide a static key to the plugin. This is a feature request, and we would need some time to process it. Meanwhile you can create your own plugin, or feel free to contribute to this repo by extending the `jwt` plugin 😉
GiteaMirror commented 2026-04-13 03:20:21 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Dec 17, 2024):

JWT plugins is made for JWKS support. Which is designed to work with asymmetric key pairs.

<!-- gh-comment-id:2547857791 --> @Bekacru commented on GitHub (Dec 17, 2024): JWT plugins is made for JWKS support. Which is designed to work with asymmetric key pairs.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#8247
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?