Support additional JWT algorithms

[kevinbader]

Currently

RIG supports hs256 only; the secret is read from JWT_SECRET_KEY.

Idea:

Joken, the library we're using for handling JWTs, supports more than just the HS* algorithms. The idea is to use the hs/rs/... functions found in signer.ex and support specifying the algorithm using an additional environment variable. For example:

JWT_ALG=HS256
JWT_KEY=my-symmetric-key

or

JWT_ALG=RS256
JWT_KEY=my-public-key

Basically, you'd do something along the lines of:

jwt_alg
|> String.downcase
|> case do
  "hs" <> _ = alg -> Signer.hs(alg, jwt_key)
  "rs" <> _ = alg -> Signer.rs(alg, jwt_key)
  ...
end

Additional thoughts

Joken does not support token encryption, which might be a future requirement. Here's a nice overview about JWT algorithms and what they're used for.