jjwt library not allow explicitly to specify hashing algorithm during token validation

Is there any way to specify the hashing algorithm while validating the token explicitly? OWASP cheatsheet suggests to specify it explicitly as best practices.

Jwts.parser().setSigningKey(key).parseClaimsJws(token);

I have tried to find a way but I haven’t found it. auth0 library https://github.com/auth0/java-jwt allow adding algorithm during token validation.

[lhazlewood]

Closing for now - happy to re-open if you can demonstrate a case where JJWT doesn’t satisfy best practices already.

[lhazlewood]

This is unnecessary with JJWT because the None algorithm - as well as using weaker or different signature verification keys - has always failed with JJWT signature verification since JJWT was first released. Auth0’s initial releases of java-jwt suffered from this security flaw, which is why they had to add support for it. There’s no reason to add it to JJWT that I can tell. I’m happy to discuss further and even enhance the library if you can demonstrate a use case that JJWT cannot satisfy though!