Validate the options passed in to jwt.decode #869
Description
We recently discovered a bug in our code that wasn't caught by tests because where we do jwt.decode we were supplying an option called "required": [...] instead of "require": [...], and so our JWTs weren't being validated to contain the expected fields.
So the call looked like this:
payload = jwt.decode(
token,
key,
algorithms=algorithms,
audience=audience,
options={
"keys": [...],
"options": {
"required": [...], # this should be: "require": [...]
},
)pyjwt doesn't complain about this, it continues without doing any checking that fields are present. It would have prevented us some pain if pyjwt raises an error when it receives an option it doesn't recognise.
If the project is willing to integrate this behaviour, I'd be happy to submit a PR making this change. 🙂