No way to decode headers

There seems to be no (public) method to decode a token’s headers - we need this for our use-case. I’m now relying on using the private _load method of the PyJWT class, which is suboptimal at best.

Would you mind me opening a PR with a new public method that just encapsulates that call to _load, returning only the headers? Something like jwt.decode_headers(token)?

[mark-adams]

Hi @dgn,

This is actually a pretty common issue since many consumers want to look up a particular key or shared secret to use when verifying the JWT and the easiest way to include that information is via a header parameter.

There is already a public API to do what you are probably looking for. You can use the jwt.get_unverified_header(token) method to retrieve the values parsed from the header. The method simply takes the header portion of the JWT from the token and returns a dictionary of the values contained in the header. Please observe caution when using this method since it parses and returns the header values without validating the signature. As a result, you should always make sure that you either reject the token based on the information in the header or continue processing it with jwt.decode() to ensure that signature validation takes place.

Hope that helps!

[acdebaca]

@mark-adams Pull request submitted with updated docs. #350