JWT token signature is not validated when parsing from configuration about jwt HOT 3 CLOSED

Parsing and validating a token are two separate steps that only advanced users should bother to deep into.

The official documentation indeed recommends in the Quick start to only deal with the JwtFacade

from jwt.

Exactly, here you can find all the information about validation constraints too - which can also be used in the facade.

Feel free to share ideas on improving the documentation (PRs are really appreciated 👍).

P.S.: I noticed the usage of FrozenClock on your snippet, be mindful that it's mainly designed for tests. In your case, the impact is contained as the facade instance is likely not reused but if you do reuse it, it might not detect token expiration properly (your "now" is pointing to a fixed value).

from jwt.

Closing as question since it's not an issue on the lib.

from jwt.