Marked HMAC SHA based algorithms as insecure and obsolete

src/JWT/Algorithms/HMACSHA256Algorithm.cs

@@ -1,10 +1,12 @@
-using System.Security.Cryptography;
+using System;
+using System.Security.Cryptography;
 
 namespace JWT.Algorithms
 {
     /// <summary>
     /// HMAC using SHA-256
     /// </summary>
+    [Obsolete(ObsoleteMessage, error: false)]
     public sealed class HMACSHA256Algorithm : HMACSHAAlgorithm
     {
         /// <inheritdoc />

src/JWT/Algorithms/HMACSHA384Algorithm.cs

@@ -1,10 +1,12 @@
-using System.Security.Cryptography;
+using System;
+using System.Security.Cryptography;
 
 namespace JWT.Algorithms
 {
     /// <summary>
     /// HMAC using SHA-384
     /// </summary>
+    [Obsolete(ObsoleteMessage, error: false)]
     public sealed class HMACSHA384Algorithm : HMACSHAAlgorithm
     {
         /// <inheritdoc />

src/JWT/Algorithms/HMACSHA512Algorithm.cs

@@ -1,10 +1,12 @@
-using System.Security.Cryptography;
+using System;
+using System.Security.Cryptography;
 
 namespace JWT.Algorithms
 {
     /// <summary>
     /// HMAC using SHA-512
     /// </summary>
+    [Obsolete(ObsoleteMessage, error: false)]
     public sealed class HMACSHA512Algorithm : HMACSHAAlgorithm
     {
         /// <inheritdoc />

src/JWT/Algorithms/HMACSHAAlgorithm.cs

@@ -1,22 +1,26 @@
-using System.Security.Cryptography;
-
-namespace JWT.Algorithms
-{
-    public abstract class HMACSHAAlgorithm : IJwtAlgorithm
-    {
-        /// <inheritdoc />
-        public abstract string Name { get; }
-
-        /// <inheritdoc />
-        public abstract HashAlgorithmName HashAlgorithmName { get; }
-
-        /// <inheritdoc />
-        public byte[] Sign(byte[] key, byte[] bytesToSign)
-        {
-            using var sha = CreateAlgorithm(key);
-            return sha.ComputeHash(bytesToSign);
-        }
-
-        protected abstract HMAC CreateAlgorithm(byte[] key);
-    }
-}
+using System;
+using System.Security.Cryptography;
+
+namespace JWT.Algorithms
+{
+    [Obsolete(ObsoleteMessage, error: false)]
+    public abstract class HMACSHAAlgorithm : IJwtAlgorithm
+    {
+        internal const string ObsoleteMessage = "HMAC SHA based algorithms are not secure to protect modern web applications. Consider switch to RSASSA or ECDSA.";
+
+        /// <inheritdoc />
+        public abstract string Name { get; }
+
+        /// <inheritdoc />
+        public abstract HashAlgorithmName HashAlgorithmName { get; }
+
+        /// <inheritdoc />
+        public byte[] Sign(byte[] key, byte[] bytesToSign)
+        {
+            using var sha = CreateAlgorithm(key);
+            return sha.ComputeHash(bytesToSign);
+        }
+
+        protected abstract HMAC CreateAlgorithm(byte[] key);
+    }
+}

src/JWT/Algorithms/HMACSHAAlgorithmFactory.cs

@@ -3,6 +3,7 @@
 namespace JWT.Algorithms
 {
     /// <inheritdoc />
+    [Obsolete(HMACSHAAlgorithm.ObsoleteMessage, error: false)]
     public class HMACSHAAlgorithmFactory : JwtAlgorithmFactory
     {
         protected override IJwtAlgorithm Create(JwtAlgorithmName algorithm)

src/JWT/JWT.csproj

@@ -24,7 +24,7 @@
     <Authors>Alexander Batishchev, John Sheehan, Michael Lehenbauer</Authors>
     <PackageTags>jwt;json;authorization</PackageTags>
     <PackageLicense>CC0-1.0</PackageLicense>
-    <Version>9.0.0-beta3</Version>
+    <Version>9.0.0-beta4</Version>
     <FileVersion>9.0.0.0</FileVersion>
     <AssemblyVersion>9.0.0.0</AssemblyVersion>
     <RootNamespace>JWT</RootNamespace>