Skip to content

fix: add "none" algorithm for JWS#44

Merged
lepture merged 2 commits into
mainfrom
fix-42
Apr 20, 2025
Merged

fix: add "none" algorithm for JWS#44
lepture merged 2 commits into
mainfrom
fix-42

Conversation

@lepture
Copy link
Copy Markdown
Member

@lepture lepture commented Apr 19, 2025

This will fix #42

@lepture lepture requested a review from azmeuk April 19, 2025 06:40
@azmeuk
Copy link
Copy Markdown
Member

azmeuk commented Apr 19, 2025

jwt.decode(payload, None) and jwt.encode({"alg":"none"}, {"foo":"bar"}, None) raise an exception due to this line:

raise UnsupportedAlgorithmError(f"Algorithm of '{name}' is not recommended")

Maybe a warning would be better? Anyway I think users should enable or disable warnings about recommended algorithms, because it can quickly be noisy. This can be the subject of another ticket though.

LGTM otherwise. Thank you 🙏

@lepture
Copy link
Copy Markdown
Member Author

lepture commented Apr 19, 2025

This is because none is not a recommended algorithm. You need to pass supported algorithms manually: https://jose.authlib.org/en/guide/jws/#unsupportedalgorithmerror

@azmeuk
Copy link
Copy Markdown
Member

azmeuk commented Apr 19, 2025

Ok. I am not totally accustomed to joserfc yet :)
Anyway, this works great. Thank you!

@lepture lepture merged commit cf0ad49 into main Apr 20, 2025
2 checks passed
@lepture lepture deleted the fix-42 branch April 20, 2025 04:27
azmeuk added a commit to azmeuk/authlib that referenced this pull request Apr 20, 2025
azmeuk added a commit to azmeuk/authlib that referenced this pull request Apr 21, 2025
azmeuk added a commit to authlib/authlib that referenced this pull request Apr 23, 2025
nixroxursox pushed a commit to nixroxursox/authlib that referenced this pull request Jun 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support none alg

2 participants