Add warning when decoding with no algorithms specifiedfix-vuln

1 files changed, 6 insertions, 0 deletions

diff --git a/jwt/api_jws.py b/jwt/api_jws.py
index 8910751..097b46a 100644
--- a/jwt/api_jws.py
+++ b/jwt/api_jws.py
@@ -117,6 +117,12 @@ class PyJWS(object):
 
     def decode(self, jws, key='', verify=True, algorithms=None, options=None,
                **kwargs):
+
+        if not algorithms:
+            warnings.warn('The algorithms parameter is required when decoding. ' +
+                          'Please specify only the expected algorithms.',
+                          DeprecationWarning)
+
         payload, signing_input, header, signature = self._load(jws)
 
         if verify: