You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
EdDSA is currently not a supported algorithm, it would be great if it could be, however I know that the algorithm support comes from a dependency. Since that is mostly outside the purview of this library, I will also propose a feature request to add a flag to ignore the algorithm (--ignore-alg or similar). My main use case is to just decode the JWT's payload—which of course doesn't require validation of the algorithm or the headers at all. It would certainly be nice to have, but I'm wondering if it makes sense to block the ability to decode the payload.
Steps to reproduce
jwt decode "jwt.encoded.with.EdDSA" outputs the following:
The JWT provided is invalid because Error(Json(Error("unknown variant `EdDSA`, expected one of `HS256`, `HS384`, `HS512`, `ES256`, `ES384`, `RS256`, `RS384`, `RS512`, `PS256`, `PS384`, `PS512`", line: 1, column: 26)))
Expected behavior
The decoded JWT perhaps with a warning instead that the algorithm was not supported OR the ability to add a flag, e.g. jwt decode --ignore-alg "jwt.encoded.with.EdDSA", to decode and validate the payload.
The text was updated successfully, but these errors were encountered:
MichaelBoselowitz
changed the title
Support for EdDSA (or don't validated the algorithm)
Support for EdDSA (or don't validate the algorithm)
Mar 14, 2022
Summary
EdDSA
is currently not a supported algorithm, it would be great if it could be, however I know that the algorithm support comes from a dependency. Since that is mostly outside the purview of this library, I will also propose a feature request to add a flag to ignore the algorithm (--ignore-alg
or similar). My main use case is to just decode the JWT's payload—which of course doesn't require validation of the algorithm or the headers at all. It would certainly be nice to have, but I'm wondering if it makes sense to block the ability todecode
the payload.Steps to reproduce
jwt decode "jwt.encoded.with.EdDSA"
outputs the following:Expected behavior
The decoded JWT perhaps with a warning instead that the algorithm was not supported OR the ability to add a flag, e.g.
jwt decode --ignore-alg "jwt.encoded.with.EdDSA"
, to decode and validate the payload.The text was updated successfully, but these errors were encountered: