{"action":"created","issue":{"url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/59","labels_url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/59/labels{/name}","comments_url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/59/comments","events_url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/59/events","html_url":"https://github.com/dgrijalva/jwt-go/issues/59","id":65618581,"number":59,"title":"Vulnerabilities in JSON Web Token","user":{"login":"wunki","id":825,"avatar_url":"https://avatars.githubusercontent.com/u/825?v=3","gravatar_id":"","url":"https://api.github.com/users/wunki","html_url":"https://github.com/wunki","followers_url":"https://api.github.com/users/wunki/followers","following_url":"https://api.github.com/users/wunki/following{/other_user}","gists_url":"https://api.github.com/users/wunki/gists{/gist_id}","starred_url":"https://api.github.com/users/wunki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wunki/subscriptions","organizations_url":"https://api.github.com/users/wunki/orgs","repos_url":"https://api.github.com/users/wunki/repos","events_url":"https://api.github.com/users/wunki/events{/privacy}","received_events_url":"https://api.github.com/users/wunki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-01T06:54:32Z","updated_at":"2015-04-01T17:00:01Z","closed_at":null,"body":"Hi,\r\n\r\nI believe some of the vulnerabilities mentioned in this article are also applicable to this library:\r\n\r\n[Critical vulnerabilities in JSON Web Token libraries](https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/)\r\n\r\nThink it would be good to add an argument to the `Parse` function which tells it which algorithm to use."},"comment":{"url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/comments/88554985","html_url":"https://github.com/dgrijalva/jwt-go/issues/59#issuecomment-88554985","issue_url":"https://api.github.com/repos/dgrijalva/jwt-go/issues/59","id":88554985,"user":{"login":"rmullinnix","id":8354863,"avatar_url":"https://avatars.githubusercontent.com/u/8354863?v=3","gravatar_id":"","url":"https://api.github.com/users/rmullinnix","html_url":"https://github.com/rmullinnix","followers_url":"https://api.github.com/users/rmullinnix/followers","following_url":"https://api.github.com/users/rmullinnix/following{/other_user}","gists_url":"https://api.github.com/users/rmullinnix/gists{/gist_id}","starred_url":"https://api.github.com/users/rmullinnix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmullinnix/subscriptions","organizations_url":"https://api.github.com/users/rmullinnix/orgs","repos_url":"https://api.github.com/users/rmullinnix/repos","events_url":"https://api.github.com/users/rmullinnix/events{/privacy}","received_events_url":"https://api.github.com/users/rmullinnix/received_events","type":"User","site_admin":false},"created_at":"2015-04-01T17:00:01Z","updated_at":"2015-04-01T17:00:01Z","body":"You can restrict the key today in the user provided lookup function.  The jwt.Token is passed into the lookup function.  You can check the signing method and only return the key if it's valid for the signing method.  This would allow you to prevent the RSA public key being used with a HMAC algorithm."}}