Add algorithms to jwt.decode calls

1 files changed, 5 insertions, 3 deletions

diff --git a/fbin/fbin.py b/fbin/fbin.py
index b062c9a..d0a5a9a 100755
--- a/fbin/fbin.py
+++ b/fbin/fbin.py
@@ -253,9 +253,11 @@ def auth():
         return redirect(url_for('.index'))
     try:
         jwt.decode(token['access_token'], key=current_app.config['JWT_PUBLIC_KEY'],
-                audience=current_app.config['OAUTH_CLIENT_ID'])
+                audience=current_app.config['OAUTH_CLIENT_ID'],
+                algorithms=[current_app.config['OAUTH_JWT_ALGORITHM']])
         jwt.decode(token['refresh_token'], key=current_app.config['JWT_PUBLIC_KEY'],
-                audience=current_app.config['OAUTH_CLIENT_ID'])
+                audience=current_app.config['OAUTH_CLIENT_ID'],
+                algorithms=[current_app.config['OAUTH_JWT_ALGORITHM']])
     except jwt.InvalidTokenError as e:
         flash('Failed to verify token: {!s}'.format(e), 'error')
         return redirect(url_for('.index'))
@@ -414,7 +416,7 @@ def generate_api_key():
         'nbf': now,
         'sub': user_id,
     }
-    token = jwt.encode(data, current_app.config['SECRET_KEY'])
+    token = jwt.encode(data, current_app.config['SECRET_KEY'], algorithm=current_app.config['API_JWT_ALGORITHM'])
     return token