v5.6.2

[github-actions[bot]]

Refactor

• CryptoKey normalization is not always async (b7751f5)
• weak cache normalized CryptoKey instances (32b25a5)

Fixes

• ensure KeyObject type in Web API encrypt/decrypt (b7920bd)

---

This discussion was created from the release v5.6.2.

[AlexErrant]

Why aren't CryptoKeys derived from Uint8Array cached? Is there something special about normalized CryptoKeys that makes them candidates for caching? (Apologies if the answer is obvious; security is not my forte.)

jose/src/runtime/browser/get_sign_verify_key.ts

Lines 25 to 31 in e8cf88a

	return crypto.subtle.importKey(
	'raw',
	key,
	{ hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' },
	false,
	[usage],
	)

[panva]

Uint8Array can have its value changed and that chance would not be observed with a weak cache.

[AlexErrant]

The following is not a feature request; I'm just theorycrafting.

Perhaps WeakRefs and FinalizationRegistry could serve as the cache, where the Uint8Array key is base64ed and the value is the CryptoKey. Note that some runtimes (cough Cloudflare cough) do not support FinalizationRegistry so you'd need another mechanism to remove useless entries.