Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Internal ChangesKind: in v2.1.269,
Internal ChangesSection of the release
What
Session events used to be signed synchronously using Node's built-in cryptography library with a raw private key held in the process. Signing is now asynchronous and delegates the actual signing operation to an injected signer object, rather than performing the cryptographic signature in-process against local key material.
Why
Moving signing to a delegated, asynchronous signer means the private key material no longer needs to live directly in the process doing the signing, which can support setups where signing happens through a separate, more controlled component.
