Is it possible to decode the payload without validating the signature?

[krzkrzkrz]

Is it possible to decode the payload without validating the signature?

c="eyJpZCI6MSwidHlwZSI6Im1hbmFnZW1lbnQiLCJpYXQiOiIyMDE1LTA4LTA2VDE1OjA3OjEyLjM3MFoiLCJleHAiOjE0MzkxMzI4MzJ9"

Base64.decode64(c)
"{\"id\":1,\"type\":\"management\",\"iat\":\"2015-08-06T15:07:12.370Z\",\"exp\":1439132832}"

I tried using the Base64 lib, but it returns the result in an escaped formatted string

[aj-michael]

Yes. As discussed in the README, the third (optional) parameter of ::JWT.decode is a boolean that is whether or not to check validation. It will typically look like this:

claims, header = JWT.decode(raw_jwt_token, nil, false)

If you think the README is not descriptive enough of this matter, please send a pull request that addresses what part confused you.

[krzkrzkrz]

Ahhh, README is fine. I must have missed it. 4am here. Closing for now. Thanks