Open revilwang opened 4 years ago
We use the jsonwebtoken package quite transparently, so yes, this is possible. Just a thought, though... in that if you were to substitute a different signature, wouldn't you still have to know the secret to do so?
Nevertheless, I'll add in the option to specify allowed algorithms in the ACP (defaulting to... either all of them, or HS256)
According to Validating a JWT,
But no algorithm configuration found. The jsonwebtoken has an example to validate against the algorithm.
Hope this is supported.