Hasura Auth Clarifications

75 Views Asked by Elan cheziyan At 20 October 2024 at 20:16

I have 2 things which i would like to confirm before moving forward with the workaround i have in mind.

When using JWT Auth with HS256 algorithm, i have a key which is less than 32 characters in length. I'm getting this error - "Error in $: Invalid JWK: Key size too small; should be at least 32 characters". So is this is an hard requirement ? or is there any trick to change this into a warning instead of an error ?
Is it possible for us to customise the Hasura Console Authentication from admin secret ? for lets say to SSO or anything ?

There are 1 best solutions below

Abdullah Saleem On 10 October 2022 at 12:10

For the first one, yes it is a hard requirement. you can read more about it in RFC 7518

A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This requirement is based on Section 5.3.4 (Security Effect of the HMAC Key) of NIST SP 800-117 [NIST.800-107], which states that the effective security strength is the minimum of the security strength of the key and two times the size of the internal hash value.)