python-jose implements JWT / JWS / JWE. jwt.decode() is the canonical validation entry point. Finding when algorithms=['none'] is passed (unsigned token acceptance) or verify_signature=False.
.get_unverified_header().get_unverified_claims().decode().get_unverified_header()Sourcejose.jwt.get_unverified_header(token) -> dict
Reads the JWT header without verifying the signature. Finding when return value drives auth decisions.
return.get_unverified_claims()Sourcejose.jwt.get_unverified_claims(token) -> dict
Reads claims without verifying. Finding for authz code.
return.decode()Sanitizerjose.jwt.decode(token, key, algorithms=None, options=None, ...) -> dict
Verifies and decodes a JWT. Finding when algorithms contains 'none' or options disable verification.
return.encode()Neutraljose.jwt.encode(claims, key, algorithm='HS256', ...) -> str
Signs a JWT. Safe with a proper algorithm.
| FQN | Field | |
|---|---|---|
| jose | fqns[0] | |
| jose.jwt | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyJose