xaicron/p5-JSON-WebToken — pull request #8 by zentooo (2014-12-15 06:29:07+00:00)
Title: not to accept algorithm none by default

According to https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms#section-3.6, JWS implementations must not accept header with { "alg": "none" } by default.

> Implementations that support Unsecured JWSs MUST NOT accept such
> objects as valid unless the application specifies that it is
> acceptable for a specific object to not be integrity protected.