Re-add 'only decode' functionality

jitsi / luajwtjitsi

JWT tokens for Lua

MIT License

18 stars 10 forks source link

Closed joelsdc closed 2 years ago

joelsdc commented 2 years ago

Hi,

Since v3.0 the decode functionality has been removed but the README still states that it exists

-- only decode
local unsafe, err = jwt.decode(token)

Any chance you can re-add that functionality?
Was removing it just part of a cleanup or was the code really insecure?
If the previous code was insecure, maybe we can find a way of keeping that functionality but without compromising security?

Thanks!

joelsdc commented 2 years ago

For now I've pinned to v2.0 but I'd love to know if it's viable to add it back.

saghul commented 2 years ago

It will not be coming back because more extra checks are necessary, it's unsafe. We'll fixup the README.