encrypting payload

[sshbio]

encrypting payload

[goozo]

@jfromaniello what would you recommend as a node lib which would asymmetrically encrypt JWTs from node-jsonwebtoken ?

[sshbio]

Is it useful adding possibility of encrypting payload using AES to the api?
I implemented such feature for my project and I think it can be useful in cases when payload data should be kept hidden from the client side.
I don't know whether I should release it on a different module or it can be merge to this project via pull request.

[jfromaniello]

The standard JWT describe two things signing (JWS: JSON Web Signature) and encryption (JWE: json web encription).

With JWE you don't encrypt the payload but the signed JWT.

There are some implementations of JWE for node.js and I will definitely consider a pull request including support for JWE tokens.

[mavvverick]

@jfromaniello Hey, I have integrated JWE encryption within node-jsonwebtoken based on works of node-webtokens.

I have implemented modifications in sign.js which takes extra options key 'encrypt' to opt JWE automatically and verify.js is [WIP].

jwt.sign({ foo: 'bar' }, cert, { algorithm: 'RSA-OAEP', encrypt: 'A256GCM' },function (err, signedToken) { console.log(signedToken); })

JWE uses crypto.js for content and key encryption which is included in lib, please check supported key management algorithms and content encryption algorithms here.

Do let me know if it looks good and I will raise a pull request for same.

Note, Work In Progress: jwt.verify()