From aaccee1718ab72f09bc686065079f8d939339869 Mon Sep 17 00:00:00 2001 From: Filippo Tessarotto Date: Mon, 7 Nov 2022 12:41:58 +0100 Subject: [PATCH] Document why `none` is not supported --- docs/supported-algorithms.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/supported-algorithms.md b/docs/supported-algorithms.md index 7143b498..0115e644 100644 --- a/docs/supported-algorithms.md +++ b/docs/supported-algorithms.md @@ -36,4 +36,10 @@ They're usually recommended for scenarios where creation is handled by a compone | `RS512` | RSASSA-PKCS1-v1_5 using SHA-512 | `\Lcobucci\JWT\Signer\Rsa\Sha512` | `>= 2048 bits` | | `EdDSA` | EdDSA signature algorithms | `\Lcobucci\JWT\Signer\Eddsa` | `>= 256 bits` | +## `none` algorithm + +The `none` algorithm as described by [JWT standard] is intentionally not implemented and not supported. +The risk of misusing it is too high, and even where other means guarantee the token validity a symmetric algorithm +shouldn't represent a computational bottleneck with modern hardware. + [JWT standard]: https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms