From ffa9b4ae1b7016e7b6cab422959ac4af188186fd Mon Sep 17 00:00:00 2001 From: Joakim Antman Date: Tue, 25 Jul 2023 23:41:03 +0300 Subject: [PATCH] No explicit handling for the none algorithm --- lib/jwt/decode_context.rb | 4 +++- lib/jwt/default_decoder.rb | 4 +--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/jwt/decode_context.rb b/lib/jwt/decode_context.rb index ccdcba0a..39646b13 100644 --- a/lib/jwt/decode_context.rb +++ b/lib/jwt/decode_context.rb @@ -20,11 +20,13 @@ def payload end def valid_signature? + return valid_signature_for?(nil) if verification_keys.empty? + verification_keys.any? { |key| valid_signature_for?(key) } end def verification_keys - @verification_keys ||= Array(resolve_verification_keys).compact + @verification_keys ||= Array(resolve_verification_keys) end def algorithm_match? diff --git a/lib/jwt/default_decoder.rb b/lib/jwt/default_decoder.rb index 31941bf4..c2674de2 100644 --- a/lib/jwt/default_decoder.rb +++ b/lib/jwt/default_decoder.rb @@ -68,8 +68,6 @@ def decode_segments private def verify_signature - return if none_algorithm? - return if decode_context.valid_signature? raise JWT::VerificationError, 'Signature verification failed' @@ -113,7 +111,7 @@ def validate_segment_count! end def none_algorithm? - decode_context.token.alg_in_header == 'none' + alg_in_header == 'none' end def alg_in_header