Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add controls for verify_sub option in PyJWT #562

Merged
merged 1 commit into from
Nov 20, 2024

Conversation

jlucier
Copy link
Contributor

@jlucier jlucier commented Nov 20, 2024

This PR addresses the discussion in this issue: #561

For people who have historically been using values for the sub claim other than strings, they may need or want the ability to control PyJWT's new behavior (as of 2.10.0) which is to reject those tokens as invalid.

This work adds a new option JWT_VERIFY_SUB which can be used to control the verify_sub option when calling jwt.decode(...) from the PyJWT library.

The default value for JWT_VERIFY_SUB is True, which results in the sub claim being verified. This default results in no change to how the library behaved prior to this addition. By choosing to set JWT_VERIFY_SUB to False, the user can turn off the verify_sub option in the jwt.decode call.

I welcome feedback on the naming or anything else regarding the implementation. Also, please let me know if I missed any places where this needs to be tested or documented. Thanks!

Copy link
Owner

@vimalloc vimalloc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, thanks for putting this together!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants