You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[^hmac]: [Section 3.2 of RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518#section-3.2)
@@ -44,4 +44,4 @@ We often get asked why the HMAC signing method only supports `[]byte` and not `s
44
44
45
45
Second, using `string` as a key type to represent a symmetric key can lead to unwanted situations. It gives the impression that this is something 'human readable' (like a password), but it is not. A symmetric key should contain as much entropy as possible and therefore include characters from the whole character set (even 'unreadable' ones) and ideally be generated by a cryptographic random source, such as [`rand.Read`](https://pkg.go.dev/crypto/rand#Read). Signing tokens with a cryptographically weak key will compromise the security of the tokens and in effect everything that depends on it, e.g., user authentication.
46
46
47
-
If you have trouble handling a `[]byte` key in our setup, e.g., because you are reading it from your environment variables on your cluster or similar, you can always use base64 encoding to have the key as a "string" type outside of your program and then use [`base64.Encoding.DecodeString`](https://pkg.go.dev/encoding/base64#Encoding.DecodeString) to decode the base64 string into the `[]byte` slice that the signing method needs.
47
+
If you have trouble handling a `[]byte` key in our setup, e.g., because you are reading it from your environment variables on your cluster or similar, you can always use base64 encoding to have the key as a "string" type outside of your program and then use [`base64.Encoding.DecodeString`](https://pkg.go.dev/encoding/base64#Encoding.DecodeString) to decode the base64 string into the `[]byte` slice that the signing method needs.
0 commit comments