How to Generate jwt token with encrypted private key and passphrase

Question

I am tring to generate jwt token with below code

const { join } = require("path");
const { readFileSync } = require("fs");
const PRIVATE_KEY_PATH = join(__dirname, "./keys/private.pem");

const jws = require("jws");
const ALG = "PS256";

const privateKey = {
    key: readFileSync(PRIVATE_KEY_PATH, "utf8").toString(),
    passphrase: "Passphrasehere",
};
const payload = {
    foo: "bar",
};

const token = jws.sign({
    header: { alg: ALG },
    payload,
    privateKey,
});

But it showing error -

TypeError [ERR_INVALID_ARG_TYPE]: The "key.key" property must be of type string or an instance of Buffer, TypedArray, DataView, or KeyObject. Received an instance of Object at prepareAsymmetricKey (internal/crypto/keys.js:288:13)

Bench Vue · Answer

I found one type in your code at line 5

This code will be works. I saved it file name with create-token.js

const { join } = require("path");
const { readFileSync } = require("fs");
const PRIVATE_KEY_PATH = join(__dirname, "./keys/private.pem");

const jws = require("jws");
const ALG = "RS256";

const privateKey = {
    key: readFileSync(PRIVATE_KEY_PATH, "utf8").toString(),
    passphrase: "Passphrasehere",
};
const payload = {
    foo: "bar",
};

const token = jws.sign({
    header: { alg: ALG },
    payload,
    privateKey,
});

console.log(token);

I demoed step by step.

1 Create private key by openssl.

if not install openssl in your windows, try to install it

if use linux, install from your OS

mkdir keys
openssl genrsa -out ./keys/private.pem 2048

Generating RSA private key, 2048 bit long modulus (2 primes)
.............+++++
..............................................+++++
e is 65537 (0x010001)

2 Confirm private key is readable text

cat ./keys/private.pem

3 Install jws

npm i jws

added 5 packages, and audited 6 packages in 1s

1 package is looking for funding
  run `npm fund` for details

found 0 vulnerabilities

4 RUN program

node create-token.js

eyJhbGciOiJSUzI1NiJ9.eyJmb28iOiJiYXIifQ.ZKtyEveGTN_tVC-M8NqqEDv1mbN6aJcWJpf4W7xU
hEwMAD1MrHl2o_-Ob8D97WjnBpL94bqftBDZV3GtY2EqsjURg52jgrRajytQ6qStrgTQKOGEUMAbBIiW
BqLOPRS9s7CWDUX0IhYci8QSZkO34Hh9tzHBfKnlkedtjSP_9MwNKSOGCMoq7MBKQHecR_xkGVaangNt
yjvM4bQ8I_dclSvlyYn4htVvzeT6zX6Ja3D_Ny6su8vedKj9Q_ioPxcPWjA89U95M1l2WVrEs_KAl2WT
kZ4-jCxm3k9PwrrfvN2GhGduBBLA-6AuiD1W0h-R7oFTyOpOOvOfyDTRMVgd6A

5 Verify your token is correct by JSON web token

Copy from Step 4, paste it into jwt.io 's Encoded section. you can see Decoded part's payload section. It should be matched create-token.js 's payload code at line 9.

From feedback, The algorithm is not typo. "PS256"( RSASSA-PSS signature with signature using SHA256 as the hash and MGF1-SHA256)

I can generate key and certificate and I can reproduce it but I don't know how to fix it.

openssl req -x509 -newkey rsa-pss -keyout rsassaPss-noRestrictions.key -out rsassaPss-noRestrictions.crt -nodes  -pkeyopt rsa_keygen_bits:2048 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:16 -sigopt rsa_mgf1_md:sha1 -sha1

it will generate two files(certificate and private key)

rsassaPss-noRestrictions.crt  rsassaPss-noRestrictions.key

How to Generate jwt token with encrypted private key and passphrase

2 Answers