Remove verify from jwt.decode() to follow PyJWT v2.2.0.

[dajiaji]

According to the setup.py, simplejwt supports PyJWT v2.0.0 or later.

djangorestframework-simplejwt/setup.py

Line 59 in 7759aa8

'pyjwt>=2,<3',

In this case, you can simply remove meaningless verify argument from jwt.decode() to support PyJWT v2.2.0.

Closes #467

[Andrew-Chen-Wang]

Seems to not work either way

[dajiaji]

@Andrew-Chen-Wang Sorry for bothering you.

Since this was very easy and small fix, I skipped checking the tests.

In the latest PyJWT (v2.2.0), PyJWT.decode() cannot be overwritten with PyJWS.decode() because PyJWT.decode() does not have **kwargs. In the first place, PyJWT.decode() and PyJWS.decode() exist in different layers and play different roles, so the assumption that they can be overwritten is wrong. For now, I modified a test (test_decode_when_algorithm_not_available) to pass with the latest PyJWT.

In my development environment, all of the tests succeed without any problem.
I'm glad if you can check and merge it.

[Andrew-Chen-Wang]

Thanks for this! No bother. I'm in class rn, but do you mind checking PyJWK has the same args? I'm aware PyJWT got rid of the **kwargs, for several things, so a double check that aud, leeway, and iss, can be passed to PyJWK is ok. IIRC, if the token is PyJWK, then those args are just missing.

[dajiaji]

do you mind checking PyJWK has the same args?

PyJWS does not have the same arguments. aud, leeway, and iss are used only in PyJWT and PyJWS does nothing for the aud, leeway and iss ( because aud, iss and exp/nbf/iat(leeway) are "JWT" claims). So you don't need to care about that.

[auvipy]

do you mind checking PyJWK has the same args?

PyJWS does not have the same arguments. aud, leeway, and iss are used only in PyJWT and PyJWS does nothing for the aud, leeway and iss ( because aud, iss and exp/nbf/iat(leeway) are "JWT" claims). So you don't need to care about that.

I shouldn;t have convinced by your breaking change. that should have done in v3.0.

[Andrew-Chen-Wang]

@dajiaji since we're passing all those args in token.decode, I worry that Python will throw an error saying too many arguments.

[dajiaji]

@dajiaji since we're passing all those args in token.decode, I worry that Python will throw an error saying too many arguments.

There is no need to worry. This simplejwt does not call PyJW"S" decode() directly except for the test that I modified and PyJW"S".decode() is called only in PyJW"T".decode() with correct arguments. No unexpected arguments will be passed to the PyJW"S".decode().

@auvipy I think it is better to revert the breaking change once (and release v2.2.1) too. But anyway, this PR is useful for the future v3.0.0 release.

[auvipy]

@dajiaji since we're passing all those args in token.decode, I worry that Python will throw an error saying too many arguments.

There is no need to worry. This simplejwt does not call PyJW"S" decode() directly except for the test that I modified and PyJW"S".decode() is called only in PyJW"T".decode() with correct arguments. No unexpected arguments will be passed to the PyJW"S".decode().

@auvipy I think it is better to revert the breaking change once (and release v2.2.1) too. But anyway, this PR is useful for the future v3.0.0 release.

as already reverted

[Andrew-Chen-Wang]

Cool thanks so much @dajiaji !

I agree, the PR will at least prevent any more breaking features for 3.0.0 upgrade.

[felippem]

@Andrew-Chen-Wang will you release a version of this PR?

[Andrew-Chen-Wang]

@felippem yes. If possible, can you create a PR for the CHANGELOG (I can't approve my own PRs). Try to match the style; if you can't, it's alright since I can fix it by editing your branch; I just need a PR.

[felippem]

@felippem yes. If possible, can you create a PR for the CHANGELOG (I can't approve my own PRs). Try to match the style; if you can't, it's alright since I can fix it by editing your branch; I just need a PR.

@Andrew-Chen-Wang Done: #476