diff --git a/src/core/authorization_request/verification/did.rs b/src/core/authorization_request/verification/did.rs index cd69956..42fba26 100644 --- a/src/core/authorization_request/verification/did.rs +++ b/src/core/authorization_request/verification/did.rs @@ -40,6 +40,14 @@ pub async fn verify_with_resolver( bail!("request was signed with unsupported algorithm: {alg}") } + // This bypass is for unencoded JWT requests, but we will need to change this later + // so that trust is preserved when receiving unencoded requests + // NOTE: This requires that `Algorithm::None` is permitted in the wallet metadata + // Otherwise, this function will error in the previous assertion. + if alg.contains("none") { + return Ok(()); + } + let Json::String(kid) = headers .remove("kid") .context("'kid' was missing from jwt headers")?