Security fix (GHSA-m22w-qfmh-7pg9)
jwt.decodetreats X.509 certificates and other public key material as RS256 when no algorithm is specified
Security fix #108
jwt.decodethrows an error when the key is empty- Use constant-time comparison for HMAC signatures
- Require Node.js >= 6.6.0
Remove usage of deprecated Buffer constructor #89 @eliot-akira
Excludes coverage/ in .npmignore
Security fix #86
Add types #83
Add support for nbf and exp claims #38 @alexjab
Fix version numver #32
add extra jwt header function to encode #28
- Check for lack of token #23
- Add an algorithm parameter to the decode method #16 @gregorypratt
- Add the RS256 alg #7 [thedufer]