progrium/pyjwt — pull request #45 by skion (2014-10-18 21:25:21+00:00)
Title: Add support for alg="none".

This adds support for empty JWS signatures (`alg="none"`) while avoiding accidentally approving unsigned JWT's.

```python
In [1]: import jwt

In [2]: j=jwt.encode({"foo":"bar"}, key=None, algorithm=None)

In [3]: jwt.decode(j, verify=False)
Out[3]: {u'foo': u'bar'}

In [4]: jwt.decode(j)
---------------------------------------------------------------------------
NotImplementedError Traceback (most recent call last)
in ()
----> 1 jwt.decode(j)

/home/pieter/envs/qauth/src/pyjwt-nacl/jwt/__init__.pyc in decode(jwt, key, verify, verify_expiration, leeway)
202 # do not approve empty signatures when verification is requested
203 if header['alg'] == 'none':
--> 204 raise NotImplementedError('Cannot verify if algorithm is none')
205 verify_signature(payload, signing_input, header, signature, key,
206 verify_expiration, leeway)

NotImplementedError: Cannot verify if algorithm is none
```