From 75897957984ca807a6b437c60f4705f4044ff63b Mon Sep 17 00:00:00 2001 From: Nataliya Issayeva Date: Mon, 8 Nov 2021 13:55:01 -0500 Subject: [PATCH] Use correct JWT type and algorithm Signed-off-by: Nataliya Issayeva --- .../backend-common/src/tokens/AuthIdentityTokenManager.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts index 42c52b84fa..9487d4555b 100644 --- a/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts +++ b/packages/backend-common/src/tokens/AuthIdentityTokenManager.ts @@ -29,13 +29,13 @@ export class AuthIdentityTokenManager implements TokenManager { discovery: discovery, issuer: 'auth-identity-token-manager', }); - // TODO: (b2b-auth) how do we get this to be the right JWK type - this.key = JWK.asKey(Buffer.from(secret)) as JWK.OctKey; + this.key = JWK.asKey({ kty: 'oct', k: secret }); } async getServerToken(): Promise<{ token: string }> { - // TODO: (b2b-auth) figure out how to use HMAC as the alg - const jwt = JWT.sign({ sub: 'backstage-server' }, this.key); + const jwt = JWT.sign({ sub: 'backstage-server' }, this.key, { + algorithm: 'HS256', + }); return { token: jwt }; }