Lengthen the demo signing keys in the identity-assertion examples#3180
Conversation
The identity-assertion tutorial and its example story signed their demo ID-JAG tokens with HMAC keys of 30 and 20 bytes. PyJWT 2.11+ warns when an HS256 key is shorter than the 32-byte minimum from RFC 7518, and pyjwt is uncapped, so a fresh install already emitted that warning from the shipped example. The demo keys are now at least 32 bytes. No-Verification-Needed: docs-example demo constants; behavior driven directly
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
📚 Documentation preview
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — a trivial change that lengthens three demo HMAC signing-key constants past the 32-byte HS256 minimum so PyJWT 2.11+ no longer emits InsecureKeyLengthWarning.
What was reviewed:
- Signer/verifier key consistency: tutorial001 (signs) and tutorial002 (verifies) now share the identical 44-byte key; the story's server.py imports the key from idp.py, so the 39-byte key can't drift.
- Both new keys exceed the 32-byte RFC 7518 minimum (44 and 39 bytes).
- Checked for other references to the old literals — none remain; the docs test reads the module constants, so it's unaffected.
Extended reasoning...
Overview
This PR changes three string constants in demo/example code: docs_src/identity_assertion/tutorial001.py, docs_src/identity_assertion/tutorial002.py, and examples/stories/identity_assertion/idp.py. Each lengthens a demo HMAC signing key so it meets the 32-byte minimum for HS256 keys from RFC 7518, which PyJWT 2.11+ enforces with an InsecureKeyLengthWarning. No library code under src/ is touched.
Security risks
None introduced. These are demo constants in tutorial and example-story code, not production secrets, and the change strictly strengthens them (longer keys). The files already carry comments noting that a shared HMAC secret is a demo-only simplification of a real IdP's asymmetric signing + JWKS setup.
Level of scrutiny
Low. This is a mechanical constant change in documentation/example code with no runtime behavior change beyond suppressing a warning. The one correctness concern for a shared-secret change is signer/verifier mismatch, which I verified: tutorial001 and tutorial002 use the identical new string, and the example story's server.py imports IDP_SIGNING_KEY from idp.py (single source of truth), so both sides of each HMAC pair stay consistent. A repo-wide grep confirms no other file references the old key literals.
Other factors
The bug hunting system found no issues. The existing docs test (tests/docs_src/test_identity_assertion.py) decodes assertions using the module constants rather than hardcoded strings, so it continues to pass. The stated motivation — keeping the suite green under warnings-as-errors when the lockfile picks up pyjwt 2.13 — is consistent with the repo's filterwarnings = ["error"] pytest configuration. No migration-guide or docs-page updates are needed since no public API changed.
1 participant
The identity-assertion tutorial and its example story signed their demo ID-JAG tokens with HMAC keys of 30 and 20 bytes. PyJWT 2.11+ warns when an HS256 key is shorter than the 32-byte minimum from RFC 7518, and
pyjwtis uncapped in our dependencies, so a fresh install already emittedInsecureKeyLengthWarningfrom the shipped example. The three demo keys are now at least 32 bytes.Motivation and Context
The examples should run clean on a default install. It also keeps the test suite green on the next lockfile refresh: with warnings-as-errors, the current keys turn nine identity-assertion tests red under pyjwt 2.13.
How Has This Been Tested?
Ran the identity-assertion docs tests and the example story against pyjwt 2.13: all 15 pass with the lengthened keys (nine fail before the change).
Breaking Changes
None. Demo constants only.
Types of changes
Checklist
AI disclosure
AI assistance was used to find, implement, and validate this change; I reviewed the result and take responsibility for it.
AI Disclaimer