Having trouble grasping how to securely sign JWT with Private Key

Question

I'm looking at this example here which refers to the javascript functionality of JWT

I am trying to use javasrcipt to sign a piece of data. However, it says I have to use a Private RSA Key and it doesn't allow you to use a public key.

My goal was once a form is submitted via PHP, call this javascript function and encrypt the data.

Pardon my ignorance, but how can you use a private RSA key in javascript and keep it private at the same time?

It appears that you have to give it a private key somehow and wouldn't that private key be visible to a user using simple developer tools in the web browser?

function _genJWS() {
  var sHead = '{"alg":"RS256"}';
  var sPayload = '{"data":"HI","exp":1300819380}';
  var sPemPrvKey = document.form1.pemprvkey1.value;

  var jws = new KJUR.jws.JWS();
  var sResult = null;
  try {
    sResult = jws.generateJWSByP1PrvKey(sHead, sPayload, sPemPrvKey);
    document.form1.jwsgenerated1.value = sResult;
  } catch (ex) {
    alert("Error: " + ex);
  }
}

Answer 1

What your are looking for is not JWS (signed), but JWE (encrypted).

If you want to send secured data to a server using JWE, you must :

• get the public key of the server
• encrypt your data using this public key and produce a JWE
• send your JWE to the server.

As far as I know, there is no javascript library able to produce JWE (I may be wrong, but I found nothing).