JWS unsigned alg should be read out of the JOSE header if available about buddy-sign HOT 3 CLOSED

This is solved by https://github.com/funcool/buddy-sign/pull/78/files can we get it looked at asap?

from buddy-sign.

I like to control algorithms that are allowed for verification to avoid all kind of complications described in this article: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

from buddy-sign.

Our use case doesnt have that choice, we need to unsign a JWS that is signed by a third party who provide a JWKS per customer and whose algorithm selection is out of our control.

This isnt used for authn/authz but for some reason the third party spec defines that a claim inside a JWS (this is signed by our alg/key) is also encrypted as a JWS and we need validate and perform analysis on it.

from buddy-sign.