Currently, JWT.decode always expects to have the algorithms provided by the client.
When using JWKs this information can be redundant since supported algorithms can be resolved from the provided keys.
- RSA and HMAC keys can have the
alg property specifying the algorithm
- EC keys this information can be resolved from the
crv property
This kind of resolve will be triggered only if the client is not explicitly specifying the algorithms (the current behavior).
Do you see any security issues resolving the algorithm from the JWK?
Currently,
JWT.decodealways expects to have the algorithms provided by the client.When using JWKs this information can be redundant since supported algorithms can be resolved from the provided keys.
algproperty specifying the algorithmcrvpropertyThis kind of resolve will be triggered only if the client is not explicitly specifying the algorithms (the current behavior).
Do you see any security issues resolving the algorithm from the JWK?