Node.js 'crypto' module error in jsonwebtoken

[sumonsnote]

Recently, I have used jwt in nextjs but the nextjs gives me error below
[Error: The edge runtime does not support Node.js 'crypto' module.

I hope the problem will be solved very soon. Thank you

[gerhardcit]

Same issue when you use this on cloudflare workers.
switched to https://www.npmjs.com/package/jose takes care of that.

[utsav-flex]

also i am facing same issue, jsonwebtoken version is: "9.0.2".

• https://prnt.sc/Sad2plLjYPlm

[yumuysl]

'crypto' module is used to node.js runtime not the edge runtime

[caoh29]

vercel: https://vercel.com/docs/functions/runtimes/edge#edge-runtime-supported-apis

Its using same runtime as chrome (V8), it is not a Nodejs environment so you do not have access to crypto module

[theflyingape]

Perhaps also related, with the Nuxt v4.1.2 maintenance update to v4.1.3, my build now fails catastrophically. I suspect it's related to this new rolldown plugin feat (nuxt/nuxt#33258). I am not adept with the nuxt bundling process, but I do know that my use of jsonwebtoken is limited to the server-side auth code where node:crypto resides and does not require any rollup (or rolldown?).

I am left wondering if this package index.js needs any updating that could address this "default" export better? Why might this cause a failure off verify.js and not sign.js?

Maybe related is this other open issue (npm/node-semver#381) since psSupported.js makes use of semver and there's a long standing circular dependency bug with rollup? A workaround appears here microsoft/vscode-languageserver-node#957 (comment) to use the individual function imports for SemVer rather than the full package.

My use of jwt.verify in server/routes/api/auth/refresh.post.ts is typical:

import type { Secret, SignOptions } from 'jsonwebtoken'
import jwt from 'jsonwebtoken'
...
  // Verify
  try {
    const decoded = jwt.verify(refreshToken, <Secret>SECRET) as JwtPayload | undefined
    if (!decoded) {
      return dumpSession(`Unauthorized, refreshToken can't be verified`, 'invalid refresh token')
    }
...

Output from nuxt build:

WARN  node_modules/jsonwebtoken/verify.js (10:7): Error when using sourcemap for reporting an error: Can't resolve original location of error.          10:30:16 AM


[nitro 10:30:16 AM]  ERROR  RollupError: node_modules/jsonwebtoken/verify.js (10:7): "default" is not exported by "node:crypto?commonjs-external", imported by "node_modules/jsonwebtoken/verify.js".


 8: import require$$6 from "\u0000/home/rhurst/src/node/bilh-edi-devops/node_modules/jsonwebtoken/lib/psSupported.js?comm...
 9: import require$$7 from "\u0000file:///home/rhurst/src/node/bilh-edi-devops/node_modules/jws/index.js?commonjs-external";
10: import require$$8 from "\u0000node:crypto?commonjs-external";
           ^
11: 
12: const JsonWebTokenError = require$$0;