Unexpected JWT alg received, expected HS256, got: RS256

I am having issues using HS256 signing algorithm:

BadRequestError: unexpected JWT alg received, expected HS256, got: RS256 at /<project-path>/node_modules/express-openid-connect/middleware/auth.js:121:19 at runMicrotasks () at processTicksAndRejections (internal/process/task_queues.js:95:5)

server.js

  app.use(
    auth({
      authRequired: true,
      idpLogout: true,
      idTokenSigningAlg: 'HS256',
      issuerBaseURL: process.env.ISSUER_BASE_URL,
      clientID: process.env.CLIENT_ID,
      authorizationParams: {
        response_type: "code",
        audience: process.env.AUDIENCE,
        scope: "openid profile email",
      },
    })
  );

.env

CLIENT_ID=Kr***********************WhTI
BASE_URL=http://localhost:3000
CLIENT_SECRET=wd************************************************tRLg99
AUDIENCE=https://my-audience
SECRET=0y************************ySlx
ISSUER_BASE_URL=https://mydomain.auth0.com
PORT=3000

Dependencies:

    "express": "4.18.1",
    "express-openid-connect": "2.8.0",
    "express-session": "^1.17.3",

– node v14.17.6

Am I missing something?

I also added a console.log in /node_modules/express-openid-connect/middleware/auth.js to print client object, and I got:

Client {
  authorization_signed_response_alg: 'RS256',
  client_id: 'Kr**********************hTI',
  client_secret: 'wdj***************************************RLg99',
  grant_types: [
    'authorization_code'
  ],
  id_token_signed_response_alg: 'HS256',
  response_types: [
    'code'
  ],
  revocation_endpoint_auth_method: 'client_secret_basic',
  token_endpoint_auth_method: 'client_secret_basic'
}

[adamjmcgrath]

OK, Thanks for sharing that

For the purposes of this SDK, you should use Regular Web Application - which will resolve this issue for you, so closing

But I’ll be sure to follow up with the relevant teams offline to resolve the issue you’ve discovered

[lissettdm]

Hi @lissettdm - could you share how you were able to create a “Single Page Application” app with ID Token Signing Alg set to HS256?

@adamjmcgrath This is what I did (Application was already created as SPA with signing algorithm RS256). To change signing algorithm I went to

• Application Settings -> Advanced Settings -> Oauth
• OIDC Conformant is active and JSON Web Token (JWT) Signature Algorithm dropdown is disabled

• Deactivate OIDC Conformant option
• JSON Web Token (JWT) Signature Algorithm dropdown is enable and you can switch between option