{"action":"created","issue":{"url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/169","labels_url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/169/labels{/name}","comments_url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/169/comments","events_url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/169/events","html_url":"https://github.com/zquestz/omniauth-google-oauth2/pull/169","id":63586410,"number":169,"title":"Override validation on JWT token for openid id_token","user":{"login":"xlembouras","id":536196,"avatar_url":"https://avatars.githubusercontent.com/u/536196?v=3","gravatar_id":"","url":"https://api.github.com/users/xlembouras","html_url":"https://github.com/xlembouras","followers_url":"https://api.github.com/users/xlembouras/followers","following_url":"https://api.github.com/users/xlembouras/following{/other_user}","gists_url":"https://api.github.com/users/xlembouras/gists{/gist_id}","starred_url":"https://api.github.com/users/xlembouras/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xlembouras/subscriptions","organizations_url":"https://api.github.com/users/xlembouras/orgs","repos_url":"https://api.github.com/users/xlembouras/repos","events_url":"https://api.github.com/users/xlembouras/events{/privacy}","received_events_url":"https://api.github.com/users/xlembouras/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-22T22:45:33Z","updated_at":"2015-03-23T06:38:41Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/pulls/169","html_url":"https://github.com/zquestz/omniauth-google-oauth2/pull/169","diff_url":"https://github.com/zquestz/omniauth-google-oauth2/pull/169.diff","patch_url":"https://github.com/zquestz/omniauth-google-oauth2/pull/169.patch"},"body":"Until version 1.4.0 JWT will try to validate the token\r\nfor all fields provided. This changes in 1.4.1 but until then\r\nwe either need to specify the validation parameters\r\nor dismiss them manually."},"comment":{"url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/comments/84838655","html_url":"https://github.com/zquestz/omniauth-google-oauth2/pull/169#issuecomment-84838655","issue_url":"https://api.github.com/repos/zquestz/omniauth-google-oauth2/issues/169","id":84838655,"user":{"login":"xlembouras","id":536196,"avatar_url":"https://avatars.githubusercontent.com/u/536196?v=3","gravatar_id":"","url":"https://api.github.com/users/xlembouras","html_url":"https://github.com/xlembouras","followers_url":"https://api.github.com/users/xlembouras/followers","following_url":"https://api.github.com/users/xlembouras/following{/other_user}","gists_url":"https://api.github.com/users/xlembouras/gists{/gist_id}","starred_url":"https://api.github.com/users/xlembouras/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xlembouras/subscriptions","organizations_url":"https://api.github.com/users/xlembouras/orgs","repos_url":"https://api.github.com/users/xlembouras/repos","events_url":"https://api.github.com/users/xlembouras/events{/privacy}","received_events_url":"https://api.github.com/users/xlembouras/received_events","type":"User","site_admin":false},"created_at":"2015-03-23T06:38:41Z","updated_at":"2015-03-23T06:38:41Z","body":"The thing is that `JWT.decode` on 1.4.1 doesn't try to verify anything by default\r\n```\r\n  default_options = {\r\n    :verify_expiration => true,\r\n    :verify_not_before => true,\r\n    :verify_iss => false,\r\n    :verify_iat => false,\r\n    :verify_jti => false,\r\n    :verify_aud => false,\r\n    :verify_sub => false,\r\n    :leeway => 0\r\n  }\r\n```\r\n while on 1.4.0 and lower it has \r\n```\r\ndefault_options = {\r\n    :verify_expiration => true,\r\n    :verify_not_before => true,\r\n    :verify_iss => true,\r\n    :verify_iat => true,\r\n    :verify_jti => true,\r\n    :verify_aud => true,\r\n    :verify_sub => true,\r\n    :leeway => 0\r\n  }\r\n```\r\nand tries to verify each relevant field.\r\n\r\nsee https://github.com/progrium/ruby-jwt#support-for-reserved-claim-names"}}