Make specifying "algorithm" optional on decode

[dlavrenuek]

When decoding a signed JWT token the algorithm and algorithms options should be made optional. The algorithm is already present in the JWT header, which makes setting it manually redundant. Furthermore the signing method used by a OAuth2.0/OpenID provider might be unknown to the user, which makes implementing token validation with ruby-jwt very difficult.

Current behavior:

• algorithm or algorithms option is required when decoding a signed token

Desired behavior:

• algorithm should be set automatically from alg in JWT header

For that purpose the method allowed algorithms can be changed to automatically add the algorithm from JWT to allowed ones: https://github.com/jwt/ruby-jwt/blob/master/lib/jwt/decode.rb#L49

[anakinj]

There is a reasoning behind having the algorithm required when encoding a token. Latest discussion about that is probably found in #254

It would be convenient, but it also opens up for potential misuse.

[dlavrenuek]

@anakinj thanks for providing the information