Thanks for your pull request. It looks like this may be your first contribution to a Google open source project, in which case you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If you signed the CLA as a corporation, please let us know the company's name.

I've signed the CLA

This code change should have also updated the function header which now incorrectly describes the parameters and thrown exceptions.

Hi,
I'm not familiar with JWT, but I think from the documentation it reads that verification is a "should".
(I'm not sure, if this is the correct part of the doc as well)
https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-13#section-5.3

@scrobbleme That section of the IETF draft is entitled "Replicating Claims as Header Parameters". I read it to refer to situations where some of the claims that are inside an encrypted JWT are also sent as unencrypted headers. The verification of the unencrypted headers against the actual claims inside of the JWT is what "should" be done while verification of the claims in the actual JWT is a "must".

@sjones608 Thanks for the explanation. Quite hard to understand.

As I'm not familiar with JWT but have to use it, I try to explan, why I thought it might be optional ;)

• I'm developing using Atlassian Connect. They use JWT, so I have to too.
• There you have to decode the token before verification, as you need a value from the token to retrieve another value, which is needed for the verification (stupid, isn't it?).
• Just read at "Exposing a Service"

Beside this I managed to figure out, how I still get the information I need:

$splitted_jwt = explode('.', $_GET['jwt']);
        $header = \Firebase\JWT\JWT::jsonDecode(\Firebase\JWT\JWT::urlsafeB64Decode($splitted_jwt[0]));
        $claims = \Firebase\JWT\JWT::jsonDecode(\Firebase\JWT\JWT::urlsafeB64Decode($splitted_jwt[1]));
        $signature = \Firebase\JWT\JWT::urlsafeB64Decode($splitted_jwt[2]);