huge webtokens being ingested over the wire

using latest binaries as of today

    "koa-jwt": "3.5.1",
    "jsonwebtoken": "8.4.0",

koa-jwt had a typings issue whereby

audience: string

should have been

audience: string | string []

that was recently patched but not sent into the build yet https://github.com/koajs/jwt/issues/142

so I chose to patch it right in my node_modules directly

upon choosing to set my jwt_sign to ‘8 hrs’ or 2 or 3 anything in hrs

was sending massive webtokens back over the wire

sorry I dont have a repo to reproduce

and Im unsure to what extent the audience has to play in this

but there is potential for apps to be taken down by this huge webtoken

I switched my expiration to

const token = jwt.sign({user: entity}, this.privateKey, {expiresIn: '2 days'})

and all works ok now

this affected postman too made it hang

for minutes at a time

[omsmith]

@ziluvatar @nhhockeyplayer That looks like a token that contains private information. You may want to remove it.

[omsmith]

Glad I was able to help. However, as a note, and while I don’t know your exact use-case, it’s usually not desirable to include the user’s password in the token. The token is not private data, just verifiable data.