{"action":"created","issue":{"url":"https://api.github.com/repos/bryanjos/joken/issues/27","labels_url":"https://api.github.com/repos/bryanjos/joken/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/bryanjos/joken/issues/27/comments","events_url":"https://api.github.com/repos/bryanjos/joken/issues/27/events","html_url":"https://github.com/bryanjos/joken/issues/27","id":76096257,"number":27,"title":"Signature verification is not enforced","user":{"login":"cs-victor-nascimento","id":7049728,"avatar_url":"https://avatars.githubusercontent.com/u/7049728?v=3","gravatar_id":"","url":"https://api.github.com/users/cs-victor-nascimento","html_url":"https://github.com/cs-victor-nascimento","followers_url":"https://api.github.com/users/cs-victor-nascimento/followers","following_url":"https://api.github.com/users/cs-victor-nascimento/following{/other_user}","gists_url":"https://api.github.com/users/cs-victor-nascimento/gists{/gist_id}","starred_url":"https://api.github.com/users/cs-victor-nascimento/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cs-victor-nascimento/subscriptions","organizations_url":"https://api.github.com/users/cs-victor-nascimento/orgs","repos_url":"https://api.github.com/users/cs-victor-nascimento/repos","events_url":"https://api.github.com/users/cs-victor-nascimento/events{/privacy}","received_events_url":"https://api.github.com/users/cs-victor-nascimento/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-13T19:28:46Z","updated_at":"2015-05-13T20:49:39Z","closed_at":null,"body":"Hello! Nice utility library :+1: \r\n\r\nI just think that I've found a somewhat strange behaviour. [Here](https://github.com/bryanjos/joken/blob/master/lib/joken/token.ex#L64), the first thing you do is to split the JWT and if it has only 2 parts you keep on going regardless of the algorithm passed. So, even if I configure it to ONLY use HS256, if I receive a token that has no signature, it will go on as a valid token.\r\n\r\nHere's a snippet: \r\n![screenshot from 2015-05-13 16 12 58](https://cloud.githubusercontent.com/assets/7049728/7618787/f4eac1c6-f98a-11e4-82b8-a54196575106.png)\r\n\r\nThe second time I decode it, I remove the signature and it decodes properly all the same. If I encode some valid JSON (like changing the sub claim) and simply remove the signature it will pass all the same. Even if the JOSE header has the alg correctly as HS256. \r\n\r\nI guess there should be someway to ensure signature verification if the algorithm is passed. Something like:\r\n\r\n```elixir\r\ndefp verify_signature(token, key, algorithm) do\r\n    case String.split(token, \".\") do\r\n      [ _header64, _payload64 ] ->\r\n          if algorithm == :none || is_nil(algorithm) do\r\n              { :ok, token }\r\n          else\r\n              { :error, \"Missing signature\" }\r\n      [ header64, payload64, jwt_signature ] ->\r\n        signature = :crypto.hmac(Utils.supported_algorithms[algorithm], key, \"#{header64}.#{payload64}\")\r\n\r\n        if Utils.base64url_encode(signature) == jwt_signature do\r\n            { :ok, token }\r\n        else\r\n            {:error, \"Invalid signature\"}\r\n        end\r\n      _ ->\r\n        {:error, \"Invalid JSON Web Token\"}        \r\n    end\r\n\r\n  end\r\n```\r\n\r\nIf that is ok I can send a PR!"},"comment":{"url":"https://api.github.com/repos/bryanjos/joken/issues/comments/101812417","html_url":"https://github.com/bryanjos/joken/issues/27#issuecomment-101812417","issue_url":"https://api.github.com/repos/bryanjos/joken/issues/27","id":101812417,"user":{"login":"bryanjos","id":1257573,"avatar_url":"https://avatars.githubusercontent.com/u/1257573?v=3","gravatar_id":"","url":"https://api.github.com/users/bryanjos","html_url":"https://github.com/bryanjos","followers_url":"https://api.github.com/users/bryanjos/followers","following_url":"https://api.github.com/users/bryanjos/following{/other_user}","gists_url":"https://api.github.com/users/bryanjos/gists{/gist_id}","starred_url":"https://api.github.com/users/bryanjos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bryanjos/subscriptions","organizations_url":"https://api.github.com/users/bryanjos/orgs","repos_url":"https://api.github.com/users/bryanjos/repos","events_url":"https://api.github.com/users/bryanjos/events{/privacy}","received_events_url":"https://api.github.com/users/bryanjos/received_events","type":"User","site_admin":false},"created_at":"2015-05-13T20:49:39Z","updated_at":"2015-05-13T20:49:39Z","body":":+1:  that looks perfect! I just took a look at the spec and what you proposed is the correct solution. If you make a PR I will accept it and try to make a release for hex tonight as well."}}