Specifying algorithm as none and empty signature

[paymentplugins]

When reviewing security vulnerabilities for JWT I came across the following article hosted on auth0.com

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

It appears based on my tests that if the header algorithm is set to "none" and the signature is left blank, then the parsing of the JWT is successful. For implementations that don't explicitly check that the algorithm matches (see issue 320 #320) a user could gain access to another user's information by passing whatever they like in the claims portion of the payload.

Kind Regards,

[lhazlewood]

Have you looked at #20, #36, #47, #119 and #202 ? ;)

[paymentplugins]

Thank you for the response and apologies for not going further back in the issues log.

Kind Regards,