DOMException while using hono/jwt module's sign

Question

DOMException while using hono/jwt module's sign

Opened this issue a month ago · 18 comments

yknevenky commented a month ago

What version of Hono are you using?

^4.2.3

What runtime/platform is your app running on?

Bun 1.0.3

What steps can reproduce the bug?

I am facing an issue using the hono/jwt module.

The below function is throwing an error

import { sign } from "hono/jwt";
import { SignatureKey } from "hono/utils/jwt/jws";
import { JWTPayload } from "hono/utils/jwt/types";

export async function signToken(payload: JWTPayload) {
const jwtSecret: SignatureKey = Bun.env.JWT_SECRET!;
const result = await sign(payload, jwtSecret, "ES256");
return result;
}

The exception was

DOMException {
line: 24,
column: 41,
sourceURL: "/Users/hono/dist/utils/jwt/jws.js",
stack: "importKey@[native code]\n@/Users/hono/dist/utils/jwt/jws.js:24:41\nimportPrivateKey@/Users/hono/dist/utils/jwt/jws.js:12:33\n@/Users/hono/dist/utils/jwt/jws.js:2:77\nsigning@/Users/hono/dist/utils/jwt/jws.js:1:24\n@/Users/hono/dist/utils/jwt/jwt.js:20:153\nsign@/Users/hono/dist/utils/jwt/jwt.js:19:19\n@/Users/src/utils.ts:6:28\nsignToken@/Users/src/utils.ts:1:33\n@/Users/src/auth.ts:137:35",
code: 0,
name: "DataError",
message: "Data provided to an operation does not meet requirements",
INDEX_SIZE_ERR: 1,
DOMSTRING_SIZE_ERR: 2,
HIERARCHY_REQUEST_ERR: 3,
WRONG_DOCUMENT_ERR: 4,
INVALID_CHARACTER_ERR: 5,
NO_DATA_ALLOWED_ERR: 6,
NO_MODIFICATION_ALLOWED_ERR: 7,
NOT_FOUND_ERR: 8,
NOT_SUPPORTED_ERR: 9,
INUSE_ATTRIBUTE_ERR: 10,
INVALID_STATE_ERR: 11,
SYNTAX_ERR: 12,
INVALID_MODIFICATION_ERR: 13,
NAMESPACE_ERR: 14,
INVALID_ACCESS_ERR: 15,
VALIDATION_ERR: 16,
TYPE_MISMATCH_ERR: 17,
SECURITY_ERR: 18,
NETWORK_ERR: 19,
ABORT_ERR: 20,
URL_MISMATCH_ERR: 21,
QUOTA_EXCEEDED_ERR: 22,
TIMEOUT_ERR: 23,
INVALID_NODE_TYPE_ERR: 24,
DATA_CLONE_ERR: 25,
toString: [Function: toString],
}

I use the private key by storing it in a .env file.
.env file content
JWT_SECRET=-----BEGIN PRIVATE KEY-----\nMHcCAQEEIH9XDGr9tm4CkJKspu2C3MJnFIrO7APXgEIuEfCJLShYoAoGCCqGSM49\nAwEHoUQDQgAE2ppj/fspp3OMUS4htI5XrJ3wd4bteEEJYzy9XKnVqlqgxi8JO3/E\nv5dtPcgiiYBMZIpV7KFPDcqYn+3EdXNs4w==\n-----END PRIVATE KEY-----

What is the expected behavior?

I expect the function to sign the payload.

What do you see instead?

DOMException {
line: 24,
column: 41,
sourceURL: "/Users/hono/dist/utils/jwt/jws.js",
stack: "importKey@[native code]\n@/Users/hono/dist/utils/jwt/jws.js:24:41\nimportPrivateKey@/Users/hono/dist/utils/jwt/jws.js:12:33\n@/Users/hono/dist/utils/jwt/jws.js:2:77\nsigning@/Users/hono/dist/utils/jwt/jws.js:1:24\n@/Users/hono/dist/utils/jwt/jwt.js:20:153\nsign@/Users/hono/dist/utils/jwt/jwt.js:19:19\n@/Users/src/utils.ts:6:28\nsignToken@/Users/src/utils.ts:1:33\n@/Users/src/auth.ts:137:35",
code: 0,
name: "DataError",
message: "Data provided to an operation does not meet requirements",
INDEX_SIZE_ERR: 1,
DOMSTRING_SIZE_ERR: 2,
HIERARCHY_REQUEST_ERR: 3,
WRONG_DOCUMENT_ERR: 4,
INVALID_CHARACTER_ERR: 5,
NO_DATA_ALLOWED_ERR: 6,
NO_MODIFICATION_ALLOWED_ERR: 7,
NOT_FOUND_ERR: 8,
NOT_SUPPORTED_ERR: 9,
INUSE_ATTRIBUTE_ERR: 10,
INVALID_STATE_ERR: 11,
SYNTAX_ERR: 12,
INVALID_MODIFICATION_ERR: 13,
NAMESPACE_ERR: 14,
INVALID_ACCESS_ERR: 15,
VALIDATION_ERR: 16,
TYPE_MISMATCH_ERR: 17,
SECURITY_ERR: 18,
NETWORK_ERR: 19,
ABORT_ERR: 20,
URL_MISMATCH_ERR: 21,
QUOTA_EXCEEDED_ERR: 22,
TIMEOUT_ERR: 23,
INVALID_NODE_TYPE_ERR: 24,
DATA_CLONE_ERR: 25,
toString: [Function: toString],
}

Additional information

I am quite confused why this is happening, I tried asking chatgpt, claude, none seem to work so far. All of them saying to check the format of the private key. But everything looks fine. Please help with this.

Thanks in advance.

Answer 1 · 2024-04-29T22:17:46.000Z

Hi @yknevenky

You need to store your Key without \n inside your .env file. If you format it like this you should have no issues

JWT_SECRET="-----BEGIN PRIVATE KEY-----
MHcCAQEEIH9XDGr9tm4CkJKspu2C3MJnFIrO7APXgEIuEfCJLShYoAoGCCqGSM49
AwEHoUQDQgAE2ppj/fspp3OMUS4htI5XrJ3wd4bteEEJYzy9XKnVqlqgxi8JO3/E
v5dtPcgiiYBMZIpV7KFPDcqYn+3EdXNs4w==
-----END PRIVATE KEY-----"

Answer 2 · 2024-04-30T00:24:51.000Z

Hi @NicoPlyley, Thanks for your response.

I tried that as well. Still it's throwing the same thing.

Answer 3 · 2024-04-30T00:29:16.000Z

I tested in Bun and I had no issues with it, did you try exactly what I pasted?

Answer 4 · 2024-04-30T00:41:30.000Z

Yes @NicoPlyley , This doesn't work. When I try this with jsonwebtoken package. It works. I am getting the error only with hono/jwt.

Answer 5 · 2024-04-30T01:51:48.000Z

My apologies @yknevenky you are correct, I had a different runtime running in the dev command. You are correct this is not working on Bun

Answer 6 · 2024-04-30T02:00:55.000Z

So in Bun I am having an issue when using your RSA Key. When I use this one:

JWT_SECRET="-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgevZzL1gdAFr88hb2
OF/2NxApJCzGCEDdfSp6VQO30hyhRANCAAQRWz+jn65BtOMvdyHKcvjBeBSDZH2r
1RTwjmYSi9R/zpBnuQ4EiMnCqfMPWiZqB4QdbAd0E7oH50VpuZ1P087G
-----END PRIVATE KEY-----"

There is no issue for me

Answer 7 · 2024-04-30T04:11:25.000Z

Thanks for the confirmation @NicoPlyley, and I didn't use RSA key, mine is EC256. And so you are saying that when you use a RSA in the bun, you don't face an issue. But when you are using the key that I provided, it's having an issue? If so could you please try the same with your own EC256 key?

Answer 8 · 2024-04-30T05:32:54.000Z

Ignore my bad terminology. I use ssh keys on the daily and call everything an RSA. The key I gave was generate with a p-256 curve. I pulled it off jwt.io to confirm if the key was bad or if it was related to bun or hono

Answer 9 · 2024-04-30T05:54:53.000Z

I have just tried generating my own key and have had no issues. Here is how I did it

openssl ecparam -genkey -name prime256v1 | openssl pkcs8 -topk8 -nocrypt -outform pem

Apparently the key needs to be in PKCS#8 format. The code above will generate an EC key with a p-256 curve and covert it into the proper format

Answer 10 · 2024-04-30T09:11:57.000Z

I did the same @NicoPlyley . I used the same p-256 thing, not working out with hono/jwt module. I finally went with using jsonwebtoken. Hope the hono team addresses this bug.

Answer 11 · 2024-04-30T09:21:18.000Z

I have had issues with jsonwebtoken package on the past on Bun. I would consider Jose if you want to use an alternative

Answer 12 · 2024-05-01T02:37:20.000Z

Oh no, but it's working good for me now. I think the issue is because of the packages have to support various runtimes. And seems like no one from the hono team hasn't seen this issue. Do you know whom to tag here to increase the visibility of this bug?

Answer 13 · 2024-05-01T03:44:02.000Z

Hi @yknevenky

Hmm. If the error only occurs on Bun, then it is a Bun problem. Hono supports any runtime but does not want to change behavior depending on the runtime.

Answer 14 · 2024-05-01T04:04:16.000Z

I've done a bunch of testing yesterday and found which Keys are working in other runtimes but not in Bun @yusukebe I'm away right now, but I will post my results when I get back home in a few days

Answer 15 · 2024-05-01T04:28:04.000Z

@NicoPlyley Thanks a lot!

Answer 16 · 2024-05-08T03:05:23.000Z

Hi @yknevenky

Hmm. If the error only occurs on Bun, then it is a Bun problem. Hono supports any runtime but does not want to change behavior depending on the runtime.

Oh I have posted the same on Bun repo. Let's see. Thanks @yusukebe for your response.

Answer 17 · 2024-05-08T03:12:33.000Z

I've done a bunch of testing yesterday and found which Keys are working in other runtimes but not in Bun @yusukebe I'm away right now, but I will post my results when I get back home in a few days

If you share them here, I would include it in the issue that I have raised on Bun and mention you, if it's okay for you.

Answer 18 · 2024-05-08T20:56:38.000Z

Sorry I was away for the week. I do believe it is a Bun issue like mentioned. I tested on CF Workers and Node and did not have any issues. If you want some more test information to add to your issue at Bun I can send it over but the key needs to be in PKCS#8 format for some reason.