Assigning algorithm throw an error

[jalal246]

jsonwebtoken.sign(
    { userid: 9080 },
    secret,
    { algorithm: 'RS256'}, 
);

crypto.js:283
var ret = this._handle.sign(toBuf(key), null, passphrase);
^

crypto.js:283
var ret = this._handle.sign(toBuf(key), null, passphrase);
^

Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
at Error (native)
at Sign.sign (crypto.js:283:26)
at Object.sign (c:\project\node_modules\jwa\index.js:55:45)
at Object.jwsSign [as sign] (c:\project\node_modules\jws\lib\sign-stream.js:23:24)
at Object.module.exports [as sign] (c:\project\node_modules\jsonwebtoken\sign.js:146:16)
at create (c:/project/src/server/utils/tokens/jwt.js:7:16)
at Object. (c:/project/src/server/utils/tokens/jwt.js:30:11)
at Module._compile (module.js:570:32)
at loader (c:\project\node_modules\babel-register\lib\node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (c:\project\node_modules\babel-register\lib\node.js:154:7)

[ziluvatar]

Is the secret a valid private key?
From docs:

secretOrPrivateKey is a string or buffer containing either the secret for HMAC algorithms, or the PEM encoded private key for RSA and ECDSA.

In your case, for RS256, you should pass a "PEM encoded private key".

[jalal246]

It's string.

const secret = "superSectret";
jsonwebtoken.sign(
    { userid: 9080 },
    secret,
    { algorithm: 'RS256'}, 
);

It works fine for HS256, HS384 and HS512. Applying any other algorithm throw error.

Error: crypto.js:283
var ret = this._handle.sign(toBuf(key), null, passphrase);

However reading secret from private key file solves the problem.

const secret = fs.readFileSync(__dirname + '/private.key');

Thanks