@ prefix to read a binary file cannot be used with HMAC algorithms

[jbg]

Summary

The help text claims that a value starting with @ can be provided to the -S/--secret parameter in order to read the secret from a binary file. However, this is not implemented for the HMAC algorithms (like HS256) - instead, the string starting with @ provided on the command line is used verbatim as the secret, leading to confusing signature validation issues.

This unfortunately leads this tool to encourage the exclusive use of human-readable strings as JWT secrets when using the HMAC modes, which considerably reduces the size of the keyspace.

Steps to reproduce

jwt encode -S @secret.key -a fake -i fake -p fake -s fake

Expected behavior

The bytes contained in the file secret.key are used as the JWT secret.

Actual behavior

The bytes of the string @secret.key are used as the JWT secret.