Documentation error in stateless tokens example
Author: hanumanmanCreated Aug 1, 2025Updated Aug 1, 2025
There are a couple of errors in the code example for stateless tokens on this page:
https://lucia-auth.com/sessions/stateless-tokens
1. Incorrect Signature Encoding and JWT Creation
The current example code for signing the JWT is:
const signature = await crypto.subtle.sign("HMAC", hmacCryptoKey, headerAndBodyBytes);
const encodedSignature = oslo_jwt.encodeJWT(headerJSON, bodyJSON);
const jw = headerAndBody + "." + encodedSignature;
return jwt;This seems incorrect. It should probably be converting the signature buffer to a Uint8Array and then Base64URL encoding it. There is also a typo (jw instead of jwt). The corrected version should be:
const signatureBuffer = await crypto.subtle.sign(
"HMAC",
hmacCryptoKey,
headerAndBodyBytes
);
const signature = new Uint8Array(signatureBuffer);
const encodedSignature = oslo_encoding.encodeBase64url(signature);
const jwt = headerAndBody + "." + encodedSignature;
return jwt;2. Missing keyUsages in crypto.subtle.importKey
The importKey call is missing the keyUsages parameter.
The current code is:
const hmacCryptoKey = await crypto.subtle.importKey(
"raw",
jwtHS256Key,
{
name: "HMAC",
hash: "SHA-256"
},
false
);It should be updated to include ["sign"] as the last argument:
const hmacCryptoKey = await crypto.subtle.importKey(
"raw",
jwtHS256Key,
{
name: "HMAC",
hash: "SHA-256",
},
false,
["sign"] // <-- This is missing
);Thank you for your hard work!
Source: lucia-auth/lucia