DecodingKey is validated even when disabling signature validation #438
Description
Thanks for this module, really useful!
I've been using it to decode JWT tokens without verifying them because that's not important and any concern in this specific workflow. Up until v10.0.0 I've been able to pass any DecodingKey to any validation signature as long as signature validation has been turned off, something like this:
#[derive(Clone, Debug, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
struct Claims {
some_claim: String,
}
// Setting RS265 here to match the JWT
let mut validation = jsonwebtoken::Validation::new(jsonwebtoken::Algorithm::RS256);
validation.validate_aud = false;
validation.insecure_disable_signature_validation(); // Disabling validation
// Easiest to create `DecodingKey` but this does _not_ match the signature (this is Hmac)
let dummy_key = jsonwebtoken::DecodingKey::from_secret(&[]);
let decoded = jsonwebtoken::decode::<Claims>(token, &dummy_key, &validation)
.expect("failed to read claims: {err}"))?;Trying to run this code after v10.0.0 now results in InvalidKeyFormat since even though I'm not interested in verifying the signature we call jwt_verifier_factory which will create a verifier based on the header and pass the key which may contain a different algorithm.
One fix for this is to simply pass a dummy RSA key instead, either a static one generated with something like openssl genrsa 512 | openssl rsa -pubout, or pull in a dependency on openssl and use openssl::rsa::Rsa::generate().
Unless there is some other more idiomatic way to do this? Reading the pinned issue, my interpretation is that this library is strongly against not verifying tokens so maybe this is a very intentional decision and one step further away from simplifying decoding without verifying?
Thanks!