Hi everyone!
Our security testers did a penetration testing on community site and noticed that application uses JWT (JSON Web Token) for session management. They identified that the JWT implemented uses the HS256 algorithm, which is considered a weaker algorithm. Recommendation is to use RS256 as a signing algorithm. Did anyone come across this issue and know how to fix this issue?
To fix this issue I guess you must just change your signature.
If you are trying to get a signature based on a certificat you must do something like that:
Blob signature = Crypto.signWithCertificate('rsa-sha256', Blob.valueOf(jwt), cert);
Otherwise:
Encode your private key then get your signature by using something like that:
Blob signature = Crypto.sign('rsa-sha256', Blob.valueOf(jwt), privateKey);
