Using RSA Keys (RS256)
By default, CoCart JWT uses HS256 (HMAC SHA-256) for token signing. You can switch to RS256 (RSA SHA-256) for enhanced security, especially in distributed systems.
1. Generate RSA Keys
First, generate a private/public key pair:
2. Configure Keys
Add these filters to a custom must-use plugin:
Store your keys securely and never commit them to version control. Consider using environment variables or WordPress constants in wp-config.php to store the key paths.
1. Key Storage Example
A secure way to configure keys using constants:
4. Using Key Strings Directly
Alternatively, you can use the RSA key strings directly in your code:
While using key strings directly in code is possible, it’s recommended to store them in secure environment variables or files for better security and key management.
Benefits of RS256
- Asymmetric Encryption: Different keys for signing and verification.
- Better Security: Private key can be kept secret on the authentication server.
- Scalability: Public key can be distributed to multiple verification servers.
- Standard Compliance: Widely used in enterprise applications.