Cell - JWT Component

JwtService signs, verifies and decodes JSON Web Tokens with node:crypto (no third-party dependency). Algorithms: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, and none only when listed in algorithms.

jwt:
  secret: ${env.JWT_SECRET}      # or privateKey / publicKey (PEM)
  signOptions:
    expiresIn: 2h

The options, defaults, checks and error messages are those of the jsonwebtoken package, so tokens made by either verify with the other: expiresIn / notBefore / maxAge take seconds or '2h', '7 days'; verify checks audience (strings or RegExps), issuer, subject, jwtid, nonce, with clockTolerance. Failures are JsonWebTokenError, TokenExpiredError (expiredAt) and NotBeforeError (date). The key must fit the algorithm: an HMAC secret for HS*, an RSA key of at least 2048 bits for RS* / PS* (allowInsecureKeySizes to allow less), an EC key on the matching curve for ES*.

An HMAC secret shorter than 32 bytes (without privateKey) is reported as CELL_SECURITY_WEAK_JWT_SECRET by cell check and by a production start (securityChecks of @celljs/core): a short secret can be brute-forced from one token. Use openssl rand -base64 48, or an RSA / EC key pair.

JwtUtil.sign / verify / decode do the same without the container.