Possibility of making the jwt signature verification configurable?

By far the largest part of this library right now is `jsrsassign’ but I don’t think it really needs to be. The problem with jsrsassign is that it doesn’t lend itself to treeshaking.

For example, angular oidc client is utilising:

https://www.npmjs.com/package/jsrsasign-reduced

Which contains only the methods needed to actually verify the token. It’s still a large 140kb bundle but it’s way better than the 200-300kb we have now.

Auth0 went in a slightly different direction with https://www.npmjs.com/package/idtoken-verifier which only supports RS256 tokens however it is 14kb minified + gzipped which is a massive improvement.

I presume you can’t really dictate that in this library as it needs to be somewhat generic so my suggestion is to effectively allow the verify method to be implemented by the library consumer and perhaps include the current functionality in a separate entry point so it can be tree-shaken if a user decides not to use it.

[pamapa]

I didn’t look at the PR, but I’d imagine all the response_mode stuff could also get removed if implicit is no longer supported.

i added a separate issue for this, see #162

[brockallen]

I didn’t look at the PR, but I’d imagine all the response_mode stuff could also get removed if implicit is no longer supported.