3 ms·
Hah. They could still improve it by only accepting a single algorithm, rather than a list. edit: though there could be some internal use cases where you want a
by Arnout 6y ago
Hah. They could still improve it by only accepting a single algorithm, rather than a list.
edit: though there could be some internal use cases where you want a list, but it's a tradeoff between flexibility and making it easy for people to shoot themselves in the foot.
- wongarsu 6y agoIf you don't set it it's set to a reasonable list of algorithms [0], which doesn't include "none" https://github.com/auth0/node-jsonwebtoken/blob/master/verify.js#L113 https://github.com/auth0/node-jsonwebtoken/blob/master/verif...