Fix NoMethodError when a 2 segment token is missing 'alg' header

[cmrd-senya]

This PR fixes an issue that was introduced at #425

Currently if one passes a token of 2 segments without alg header the decode method raises NoMethorError because algorithm is nil but it tries to call casecmp on it here:
https://github.com/jwt/ruby-jwt/blob/master/lib/jwt/decode.rb#L116

The expected result would be to raise an exception that is inherited from JWT::DecodeError instead of a generic exception like NoMethodError.

[anakinj]

I wonder if it would just be simpler to check if it's a string or just is truthy.

return false unless algorithm

return false unless algithm.is_a?(String)

[anakinj]

Maybe even the original approach would be the simplest.

algorithm == 'none'

[cmrd-senya]

Checking for a specific type is not very Ruby-way approach. Because Ruby promotes duck typing, and therefore it shouldn't matter if a class is directly based on a String or it implements exactly the same interface independently - the code should work anyways. So checking for the presence of a certain method is quite common in Ruby to ensure the interface of the object is supported, I think it is intentionally preferred over checking the actual class.

Checking algorithm == 'none' is fine, the only thing is that it stops supporting case-insensitive matches, but I have quickly checked the RFC and it never explicitly requires to support anything other than none.

I have also found that algorithm name is supposed to be case sensitive.

And none is listed as an algorithm name:

So I guess supporting something like None or nOnE could be seen as a spec violation.

https://datatracker.ietf.org/doc/html/rfc7518#section-7.1.1

[anakinj]

Great catch and nice with additional tests to ensure this behaviour in the future.

Added a comment about the added condition. Would suggest making the check more generic to avoid checking for a certain method.

[cmrd-senya]

@anakinj updated

[anakinj]

Looks great. Would you be so kind and add a changelog entry to the CHANGELOG.md under the "Fixes and enhancements"?

[cmrd-senya]

@anakinj done

[anakinj]

Super! Thank you for the effort fixing this!❤️