The parse method does not verify the signature of a JWT.
So it e.g. accepts a token like this:
someBase64EncodedHeader.someBase64EncodedClaims.
Notice that it accepts a token without a signature.
By using the parseClaimsJws method instead, the signature is correctly verified.
The
parse
method does not verify the signature of a JWT. So it e.g. accepts a token like this:someBase64EncodedHeader.someBase64EncodedClaims.
Notice that it accepts a token without a signature. By using theparseClaimsJws
method instead, the signature is correctly verified.