Bug report: JWT sign broken again
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
JWT sign is broken since version v10.23.0.
Looks like the same issue as in #1768
We can confirm from the channel log that in v10.23 jsonwebtoken was bumped to v9.0.0.
**To Reproduce**
Steps to reproduce the behavior or a link to the recipe / input used to cause the bug:
1. Go to [CyberChef](https://gchq.github.io/CyberChef/)
2. Add JWT sign, key, and input
3. Bake it
4. See error:
```
Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.
TypeError: Right-hand side of 'instanceof' is not an object
```
**Desktop (if relevant, please complete the following information):**
- OS: Windows
- Browser: Chrome
- CyberChef version: >10.23.0 (latest build: 11.0.0)
Contributor guide
Research direction
Start by reproducing JWT sign in CyberChef with the steps in this report, then inspect the JWT sign operation and the jsonwebtoken v9.0.0 upgrade noted in the issue. Done means JWT signing works without the reported instanceof error for the supported HMAC, RSA, and ECDSA key cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100