Merge pull request #74 from change-engine/drop-alg

MS don't set alg, so we can't validate it
change-engine · Mar 28, 2024 · c291d47 · c291d47
2 parents e6f5f75 + 7c05389
commit c291d47
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/index.ts b/src/index.ts
@@ -27,7 +27,7 @@ export async function verify<T>(token: string, iss: string, aud: string): Promis
   };
   const key = Object.fromEntries(jwks.keys.map((k) => [k.kid, k]))[head.kid];
   if (!key) return false;
-  if (key.alg !== 'RS256') return false;
+  if (key.alg && key.alg !== 'RS256') return false;
   if (
     !(await crypto.subtle.verify(
       { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } },