Getting the header from a token about jwt HOT 4 CLOSED

You can use jwtutil.Resolver for this purpose. Pass a Resolver value to the jwt.Verify function as the second "alg" parameter, as Resolver satisfies the Algorithm interface. This assumes that the reason you want the "kid" field value is to look up a key with which to verify the token's signature.

There was some previous discussion in #23 and, more recently for the current interface in #30 (comment). It's an odd design, difficult to discover on your own, but I can confirm that it does work if your goal is to look up a key by its ID.

from jwt.

Thank you! Solved my issue.

We also store custom data in our payload that we use prior to verification. The previous 3.0 beta we used allowed us to get the payload. Is there a way to still get the payload without verifying the token?

from jwt.

Sorry, all this oddity is due to the design decision of not allowing to decode the JWT without also verifying it. It might be possible to export the functions that parse header and payload, though.

from jwt.

I decided not to allow checking the payload without verifying the whole token. The intention is to make a safer API, although boring. You can always Base64 decode the raw incoming token to get whatever information you need, at your own risk. I advise against trusting information of unverified tokens.

from jwt.