Invalid issuer. Expected [], received <none> (JWT::InvalidIssuerError) after upgrading from 2.8.2 to 2.9.0

[tpaulshippy]

Issue: InvalidIssuerError is raised even though no specific issuer was specified. There was no error in 2.8.2

Sample code to illustrate the issue:

require "jwt"
hmac_secret = 'my$ecretK3y'
payload = { data: "test" }

# Encode
token = JWT.encode payload, hmac_secret, "HS256"

puts token

decoded_token = JWT.decode token, hmac_secret, true, {
  verify_iss: true,
  algorithm: "HS256"
}

puts decoded_token

Running in 2.8.2 --

Running the same code in 2.9.0 --

[tpaulshippy]

Workaround:

verify_iss: false

[tpaulshippy]

Same issue happens with verify_aud

[anakinj]

Thanks for reporting. Probably some regression not covered by tests. Taking a look.

[tpaulshippy]

Yeah once I realized that my use case was not really valid (verify the issuer that I'm not actually providing), I wasn't as concerned and fixed my code to provide the issuer. But I suspect I'm not the only one who may have made this mistake. I could see a future major version actually raising an error if you ask it to verify something without providing the info needed to verify it.

[anakinj]

There has been some comments that the way the verification is enabled is not that intuitive, needing to pass both verify_iss: true and issparameters, could be enough to just pass the expected list of issuers to enable this validation.

[anakinj]

Fixed in v2.9.1