Conversation

Notices

1. Embed this notice
   silverpill (silverpill@mitra.social)'s status on Saturday, 29-Aug-2026 20:37:36 JST silverpill

   @julian

   It works now, this time the response was quick (200 OK)

   • Embed this notice
     silverpill (silverpill@mitra.social)'s status on Sunday, 30-Aug-2026 07:35:53 JST silverpill

     in reply to

     • Terence Eden
     • mradcliffe

     @mradcliffe @julian @Edent Agreed - my implementation adds the alg parameter.

     But if I remember correctly, relying on algorithm ID alone is not always safe, and the key type should also be validated.

     https://portswigger.net/web-security/jwt/algorithm-confusion

   • Embed this notice
     mradcliffe (mradcliffe (he/him)@nokoto.org)'s status on Sunday, 30-Aug-2026 07:35:54 JST mradcliffe

     in reply to

     • Terence Eden

     @silverpill @julian It’s working for me too. I did not realize more implementations were not going to include alg parameter. I do not have a good way of deriving alg from the public key so the only thing I can do is assume rsa-v1_5-sha256 if it’s missing. I know that’s not great, but maybe we should all just agree to include alg?

     I guess @Edent feels the same way.