Open
Description
Currently, only string or string array types can be used as secret values.
Line 33 in 429cfd4
But cookie-signature allows not only string
, but also ArrayBufferView
(TypedArray
, DataView
), and crypto.KeyObject
.
The secret is for an HMAC key, so technically we can allow string
, ArrayBuffer
, Buffer
, TypedArray
, DataView
, KeyObject
, and CryptoKey
, which is described in the nodejs docs. And these types are represented as crypto.CipherKey
type.
This is also related to security concerns. See Using strings as inputs to cryptographic APIs