Comformance status on jwt.io?

[jianfeiliao]

Why does this library show a bunch red x marks on https://jwt.io/#libraries-io?

[dgrijalva]

There are no built in checks for those fields. This library is intentionally slim to allow developers flexibility. I've been thinking about how to add some of these without significantly complicating the API. They're all basically string compares where a library adds little value, if any.

-dave

On Jul 22, 2016, at 5:47 PM, jianfeiliao notifications@github.com wrote:

Why does this library show a bunch red x marks on https://jwt.io/#libraries-io?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[siscia]

Humm, similar issues with JWT.io, maybe should open a new issues, but the title of this one seems perfect.

$ cat key 
aaa
$ echo {\"foo\":\"bar\"} | jwt -key key -alg HS256 -sign - 
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIifQ.o-sa9p5QPzt21er3dLUYU-CXLwScBGI3HBT4ycmIiBk

The token produces is not verified by JWT.io.

[sagikazarmark]

Possible duplicate of #202

[karlbateman]

Critical Vulnerabilities in JSON Web Token Libraries provides some insight into those checks.