{"action":"created","issue":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/567","repository_url":"https://api.github.com/repos/begriffs/postgrest","labels_url":"https://api.github.com/repos/begriffs/postgrest/issues/567/labels{/name}","comments_url":"https://api.github.com/repos/begriffs/postgrest/issues/567/comments","events_url":"https://api.github.com/repos/begriffs/postgrest/issues/567/events","html_url":"https://github.com/begriffs/postgrest/issues/567","id":149915210,"number":567,"title":"Clarify supported algorithms for jwt","user":{"login":"drawks","id":410276,"avatar_url":"https://avatars.githubusercontent.com/u/410276?v=3","gravatar_id":"","url":"https://api.github.com/users/drawks","html_url":"https://github.com/drawks","followers_url":"https://api.github.com/users/drawks/followers","following_url":"https://api.github.com/users/drawks/following{/other_user}","gists_url":"https://api.github.com/users/drawks/gists{/gist_id}","starred_url":"https://api.github.com/users/drawks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drawks/subscriptions","organizations_url":"https://api.github.com/users/drawks/orgs","repos_url":"https://api.github.com/users/drawks/repos","events_url":"https://api.github.com/users/drawks/events{/privacy}","received_events_url":"https://api.github.com/users/drawks/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-20T23:38:44Z","updated_at":"2016-04-20T23:48:13Z","closed_at":null,"body":"I can find no reference in the docs as to what algos are implemented/supported for jwt verification. All references in docs and examples and the default value are plain ascii strings, which makes sense for symmetric schemes such as HS256, but there is no mention of support for asymmetric schemes such as RS256/512 or ES265/512.\r\n\r\nI'm not quiet haskell literate enough to determine if these are supported and if they are what encoding should be used for the public key when used as a secret for postgrest."},"comment":{"url":"https://api.github.com/repos/begriffs/postgrest/issues/comments/212654565","html_url":"https://github.com/begriffs/postgrest/issues/567#issuecomment-212654565","issue_url":"https://api.github.com/repos/begriffs/postgrest/issues/567","id":212654565,"user":{"login":"drawks","id":410276,"avatar_url":"https://avatars.githubusercontent.com/u/410276?v=3","gravatar_id":"","url":"https://api.github.com/users/drawks","html_url":"https://github.com/drawks","followers_url":"https://api.github.com/users/drawks/followers","following_url":"https://api.github.com/users/drawks/following{/other_user}","gists_url":"https://api.github.com/users/drawks/gists{/gist_id}","starred_url":"https://api.github.com/users/drawks/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drawks/subscriptions","organizations_url":"https://api.github.com/users/drawks/orgs","repos_url":"https://api.github.com/users/drawks/repos","events_url":"https://api.github.com/users/drawks/events{/privacy}","received_events_url":"https://api.github.com/users/drawks/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T23:48:12Z","updated_at":"2016-04-20T23:48:12Z","body":"After digging through the code I found my answer. The JWT library in use here appears to be **the only** jwt library in existence that has only implemented support for HS256.\r\n\r\nSeems like it would be a good idea to switch to the much more well featured https://github.com/frasertweedale/hs-jose which supports the full set of algorithms as defined in the JWT spec. \r\n\r\nNot being able to use asymmetric key pairs really reduces any security gains you get from having process separation of authentication and authorization."}}