Intermediate LevelAuthentication & Authorization
What is the difference between Symmetric (HS256) and Asymmetric (RS256/ES256) JWT signing?
❓ Interview Prompt: Compare HS256 shared secret key signing vs RS256/ES256 public/private key pair signing in microservice architectures.
Selecting JWT signing algorithms impacts key management across distributed microservices:
1. Symmetric Signing (HS256 - HMAC with SHA-256):
•
Uses a single shared secret key for both signing and verifying tokens.
•
Drawback: Every microservice that needs to verify JWTs must hold the secret key. If a downstream microservice is compromised, an attacker can forge valid tokens for the entire ecosystem!
2. Asymmetric Signing (RS256 / ES256 - RSA/ECDSA):
•
Uses a Private/Public Key Pair.
•
Auth Server holds the Private Key to sign JWTs.
•
Microservices hold ONLY the Public Key (fetched via JWKS) to verify JWT signatures.
•
Advantage: Downstream services can verify tokens without having the power to forge tokens!
Code Implementation Example
typescript
import jwt from 'jsonwebtoken';
// Auth Server signs JWT using RSA Private Key (RS256)
const privateKey = process.env.RSA_PRIVATE_KEY!;
const token = jwt.sign({ sub: 'usr_1042' }, privateKey, { algorithm: 'RS256', expiresIn: '15m' });
// Downstream Microservice verifies JWT using RSA Public Key ONLY
const publicKey = process.env.RSA_PUBLIC_KEY!;
const verifiedClaims = jwt.verify(token, publicKey, { algorithms: ['RS256'] });💡Signing JWT with RSA private key and verifying signature with public key.
🎯 Interview Key Takeaway
RS256 uses private keys to sign and public keys to verify, allowing microservices to validate JWTs without holding signing secrets.
#RS256#HS256#Asymmetric#JWT#Intermediate
Back to all Authentication & Authorization Questions→