UnauthorizedError: invalid algorithm express-jwt

Question

I am displaying some data on my website which returns from node server. It's works perfectly until today. Now I am getting below error on my server console when I go to my web page. I use Auth0 for signin in users.

UnauthorizedError: invalid algorithm
    at C:\workspace\New\MyApp\node_modules\express-jwt\lib\index.js:100:22
    at C:\workspace\New\MyApp\node_modules\express-jwt\node_modules\jsonwebtoken\index.js:155:18
    at nextTickCallbackWith0Args (node.js:420:9)
    at process._tickCallback (node.js:349:13)

What could be the issue?

Danny Sullivan · Answer 1 · 2018-07-23T16:15:16.993

HS256 is less secure because it is symmetric, (the same secret is shared between the client and server). See this question: RS256 vs HS256: What's the difference?

You can maintain RS256 by using the node-jwks-rsa module to retrieve the signing key:

import jwt from 'express-jwt'
import jwksRsa from 'jwks-rsa'

const secret = jwksRsa.expressJwtSecret({
  cache: true,
  rateLimit: true,
  jwksRequestsPerMinute: 5,
  jwksUri: 'https://<YOUR_AUTH0_DOMAIN>/.well-known/jwks.json',
})

const jwtCheck = jwt({
  secret: secret,
  audience: <YOUR_AUTH0_AUDIENCE_OR_CLIENT_ID>,
  issuer: 'https://<YOUR_AUTH0_DOMAIN>/',
  algorithms: ['RS256'],
})

app.use(jwtCheck)

score 11 · Accepted Answer · answered Oct 06 '16 at 01:39

I had the same problem. I use Auth0 for signin in users. You have to check the algorithm type.

If you're using Auth0 then go to

Client -> Settings -> Advanced Settings -> OAuth

and check the algorithm type. It has to be HS256.

If you're not using Auth0 then check the algorithm type also.

score 7 · Answer 3 · answered Oct 25 '20 at 07:24

7

Use this

expressJwt({
  secret: process.env.JWT_SECRET,
  algorithms: ['sha1', 'RS256', 'HS256'],
})

answered Oct 25 '20 at 07:24

Subbhashit Mukherjee

106
1
5

Why would this help? – Pierre.Vriens Oct 25 '20 at 09:10

score 2 · Answer 4 · answered Jan 04 '21 at 13:17

2

Use the code below in your expressJwt param():

algorithms: ['sha1', 'RS256', 'HS256'],   


Copy the algorithms and change/paste it on your function this methods helps me in postman, paw, robo 3t

answered Jan 04 '21 at 13:17

Farhan Sultan

29
1

that's basically the same answer as [this one](https://stackoverflow.com/a/64521333/7329832), and doesn't add anything new but raises the same question: Why would this help? – jps Jan 04 '21 at 14:21

UnauthorizedError: invalid algorithm express-jwt

4 Answers4