TypeError when specifying a wrong algorithm

[toshe]

So I ran my usual tests against tampered keys and I got a TypeError under MRI (2.0):

1. Provide a tampered token with "alg": "HSMAC" (with a valid signature)
2. Try to verify the token with an RSA public key
3. TypeError: no implicit conversion of OpenSSL::PKey::RSA into String

I've monkeypatched my app to also rescue TypeError and not just DecodeError but this is just a temporary solution. Interestingly the error does not appear under JRuby.

I've recently read the article about possible security flaws in the library.
I really liked the suggestion to also pass the algorithm and not just the key when verifying the token. Any thoughts on that?

[AlexParamonov]

Regarding passing the algo. It has been merged: https://github.com/progrium/ruby-jwt/pull/71/files#diff-561abf25ed278547a89be325d40babacR126 and on ruby gems now.