4 ms·

Literally incorrect. You can't verify the jwt prior to reading the header, because you don't know which of the advertised keys was used to sign the jwt. Check

• shakna 6y ago
  I assume you're refering to this part of the spec: > If the JOSE Header contains a "cty" (content type) value of "JWT", then the Message is a JWT that was the subject of nested signing or encryption operations. In this case, return to Step 1, using the Message as the JWT. [0] This is also step 8 of validating a JWT. There is a number of validation steps you need to take before you can decide how to process the payload. You'll also note that none of the previous 7 steps actually decode the payload ("the Message") - they only find it. And 4 of those steps are about verifying that the header isn't dangerous. [0] https://tools.ietf.org/html/rfc7519#section-7.2 https://tools.ietf.org/html/rfc7519#section-7.2