Review code in response to common alg vulnerability

[alexanderkjeldaas]

I have gone through all the jwt libraries on hackage, and it seems like this one actually has typed keys, and thus might be protected against this common vulnerability:

https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/

An audit of some sort and a signoff that the library is OK is needed.

[frasertweedale]

I believe that this implementation is not affected by either of the vulnerabilities outlined in the post. Nevertheless please note the disclaimer of warranty in the license.

Thank you for bringing this matter to my attention!