JWT-Secret is stored as environment variable. This secret is an ASCII secret/password.
The jsonwebtoken library uses this value as a raw AES Key for HMAC auth0/node-jsonwebtoken#620
To improve security, the JWT-Secret should be put through a KDF function like Argon2ID, scrypt, bcrypt or PBKDF2 on start-up before any JWTs are signed.
JWT-Secret is stored as environment variable. This secret is an ASCII secret/password.
The jsonwebtoken library uses this value as a raw AES Key for HMAC auth0/node-jsonwebtoken#620
To improve security, the JWT-Secret should be put through a KDF function like Argon2ID, scrypt, bcrypt or PBKDF2 on start-up before any JWTs are signed.