Web API /Authenticate/GetToken -> Unable to create KeyedHashAlgorithm for algorithm 'HS256'

1 mese tempo fa
When trying to setup an updated store with 4.6 and the Web API,  the Authentiate method on both front and backend give the following error:

"message": "IDX10720: Unable to create KeyedHashAlgorithm for algorithm 'HS256', the key size must be greater than: '256' bits, key has '176' bits. See https://aka.ms/IdentityModel/UnsafeRelaxHmacKeySizeValidation (Parameter 'keyBytes')",

"stack_trace": "System.ArgumentOutOfRangeException: IDX10720: Unable to create KeyedHashAlgorithm for algorithm 'HS256', the key size must be greater than: '256' bits, key has '176' bits. See https://aka.ms/IdentityModel/UnsafeRelaxHmacKeySizeValidation (Parameter 'keyBytes')\r\n   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.ValidateKeySize(Byte[] keyBytes, String algorithm, Int32 expectedNumberOfBytes)\r\n   at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateKeyedHashAlgorithm(Byte[] keyBytes, String algorithm)\r\n   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.CreateKeyedHashAlgorithm()\r\n   at Microsoft.IdentityModel.Tokens.DisposableObjectPool`1.CreateInstance()\r\n   at Microsoft.IdentityModel.Tokens.DisposableObjectPool`1.Allocate()\r\n   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.GetKeyedHashAlgorithm(Byte[] keyBytes, String algorithm)\r\n   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.Sign(Byte[] input)\r\n   at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)\r\n   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)\r\n   at Nop.Plugin.Misc.WebApi.Framework.Services.JwtTokenService.GetNewJwtToken(Customer customer)\r\n   at Nop.Plugin.Misc.WebApi.Backend.Services.AuthorizationAdminService.AuthenticateAsync(AuthenticateRequest request)\r\n   at Nop.Plugin.Misc.WebApi.Backend.Controllers.AuthenticateController.GetToken(AuthenticateAdminRequest request)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.TaskOfIActionResultExecutor.Execute(ActionContext actionContext, IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|20_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)\r\n   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)\r\n   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)\r\n   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)\r\n   at Nop.Services.Authentication.AuthenticationMiddleware.InvokeAsync(HttpContext context) in D:\\nopCommerce-release-4.60.5-WAS\\Libraries\\Nop.Services\\Authentication\\AuthenticationMiddleware.cs:line 94\r\n   at StackExchange.Profiling.MiniProfilerMiddleware.Invoke(HttpContext context) in C:\\projects\\dotnet\\src\\MiniProfiler.AspNetCore\\MiniProfilerMiddleware.cs:line 103\r\n   at WebMarkupMin.AspNetCore7.WebMarkupMinMiddleware.InvokeCore(HttpContext context, Boolean useMinification, Boolean useCompression)\r\n   at WebMarkupMin.AspNetCore7.WebMarkupMinMiddleware.InvokeCore(HttpContext context, Boolean useMinification, Boolean useCompression)\r\n   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)\r\n   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)\r\n   at Microsoft.AspNetCore.Session.SessionMiddleware.Invoke(HttpContext context)\r\n   at Nop.Services.Installation.InstallUrlMiddleware.InvokeAsync(HttpContext context, IWebHelper webHelper) in D:\\nopCommerce-release-4.60.5-WAS\\Libraries\\Nop.Services\\Installation\\InstallUrlMiddleware.cs:line 52\r\n   at Nop.Services.Common.KeepAliveMiddleware.InvokeAsync(HttpContext context, IWebHelper webHelper) in D:\\nopCommerce-release-4.60.5-WAS\\Libraries\\Nop.Services\\Common\\KeepAliveMiddleware.cs:line 49\r\n   at Nop.Plugin.Misc.WebApi.Framework.Middleware.JwtMiddleware.InvokeAsync(HttpContext context, IWorkContext workContext, ICustomerService customerService)\r\n   at Nop.Plugin.Misc.WebApi.Framework.Middleware.ErrorHandlerMiddleware.InvokeAsync(HttpContext context)"

Any clues as t owhat is causing this?
1 mese tempo fa
Hi. It seems that the length of your Secret Key in the plugin settings is not sufficient for the encryption algorithm to work correctly, try using a sequence of 32 characters for the key
1 mese tempo fa
Clicking the button to generate a new key, creates a secret key with only 22 characters.  I manually added an additional 10 characters to make the length 38 characters and then the GetToken call will work.

Thanks for you assistance.
George