Skip to content

Upgrading PyJWT 0.4 to 1

Breaking0.4.3 → 1.7.1Breaking3Security3Platform4Deprecated2New11Changed12Fixed20Other6

Full comparisonBack to PyJWT
BreakingUpgrade verdict

3 breaking changes and 4 platform requirement changes and 3 security fixes.

In plain terms
  • The command-line tool is now called jwt-cli instead of jwt, so anyone invoking the old command must switch.
  • A helper for reading the token header has been removed from the API.
  • Code that catches DecodeError for bad signatures must now catch InvalidSignatureError.
  • The library now works on Python 3.7.
Must act Top 5 of 12 that need code or config changes

What you must change

Breaking3
Renames the commandline script jwt to jwt-cli to avoid clobbering the jwt module.
jwtjwt-cli
1.5.0GitHub ReleaseSummarizedView source
Removes api.header.
api.header
1.0.0GitHub ReleaseSummarizedView source
An invalid signature now raises InvalidSignatureError instead of DecodeError.
InvalidSignatureErrorDecodeError
1.6.0GitHub ReleaseSummarizedView source
Security3
In PyJWT 1.5.0 and below the invalid_strings check in HMACAlgorithm.prepare_key does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string -----BEGIN RSA PUBLIC KEY----- which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
1.5.1GitHub AdvisoryOriginalView source
Adds fixes related to algorithm and key choice.
1.0.0GitHub ReleaseSummarizedView source
Adds whitelist validation support for the alg header.
alg
1.0.0GitHub ReleaseSummarizedView source
Platform4
Adds support for Python 3.7.
1.7.0GitHub ReleaseSummarizedView source
Drops support for Python 2.6 and 3.3.
1.6.0GitHub ReleaseSummarizedView source
Adds support for Python 3.6.
1.5.1GitHub ReleaseSummarizedView source
Removes support for Python 3.2; users on that version should upgrade to 3.3 or later.
1.3.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated2
Adds a deprecation warning when decoding without specifying algorithms.
PyJWT.decodealgorithms
1.5.1GitHub ReleaseSummarizedView source
Deprecates usage of the .decode(..., verify=False) parameter.
decode()verify
1.1.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • added: export ImmatureSignatureError
  • added: export InvalidAlgorithmError
  • added: export InvalidIssuedAtError
  • added: export InvalidSignatureError
  • added: export MissingRequiredClaimError
  • added: export PyJWS
  • added: export PyJWT
  • added: export PyJWTError
  • added: export get_unverified_header
  • added: export unregister_algorithm
  • added: class RSAPSSAlgorithm(RSAAlgorithm)
  • added: field ECAlgorithm.SHA256
  • added: field ECAlgorithm.SHA384
  • added: field ECAlgorithm.SHA512
  • added: field HMACAlgorithm.SHA256
  • added: field HMACAlgorithm.SHA384
  • added: field HMACAlgorithm.SHA512
  • added: field RSAAlgorithm.SHA256
  • added: field RSAAlgorithm.SHA384
  • added: field RSAAlgorithm.SHA512
  • added: function get_default_algorithms()
  • added: method RSAPSSAlgorithm.sign(msg, key)
  • added: method RSAPSSAlgorithm.verify(msg, key, sig)
  • added: static method Algorithm.from_jwk(jwk)
  • added: static method Algorithm.to_jwk(key_obj)
  • added: static method HMACAlgorithm.from_jwk(jwk)
  • added: static method HMACAlgorithm.to_jwk(key_obj)
  • added: static method RSAAlgorithm.from_jwk(jwk)
  • added: static method RSAAlgorithm.to_jwk(key_obj)
  • added: variable requires_cryptography
  • removed: function decode(jwt, key=…, verify=…, **kwargs)
  • removed: function encode(payload, key, algorithm=…, headers=…, json_encoder=…)
  • removed: function load(jwt)
  • removed: function register_algorithm(alg_id, alg_obj)
  • removed: function verify_signature(payload, signing_input, header, signature, key=…, verify_expiration=…, leeway=…, audience=…, issuer=…)
  • added: class PyJWS(object)
  • added: constructor PyJWS(algorithms=…, options=…)
  • added: field PyJWS.header_typ
  • added: method PyJWS.decode(jwt, key=…, verify=…, algorithms=…, options=…, **kwargs)
  • added: method PyJWS.encode(payload, key, algorithm=…, headers=…, json_encoder=…)
  • added: method PyJWS.get_algorithms()
  • added: method PyJWS.get_unverified_header(jwt)
  • added: method PyJWS.register_algorithm(alg_id, alg_obj)
  • added: method PyJWS.unregister_algorithm(alg_id)
  • added: variable decode
  • added: variable encode
  • added: variable get_unverified_header
  • added: variable register_algorithm
  • added: variable unregister_algorithm
  • added: class PyJWT(PyJWS)
  • added: field PyJWT.header_type
  • added: method PyJWT.decode(jwt, key=…, verify=…, algorithms=…, options=…, **kwargs)
  • added: method PyJWT.encode(payload, key, algorithm=…, headers=…, json_encoder=…)
  • added: variable decode
  • added: variable encode
  • added: variable get_unverified_header
  • added: variable register_algorithm
  • added: variable unregister_algorithm
  • removed: function timedelta_total_seconds(delta)
  • added: function bytes_from_int(val)
  • added: variable binary_type
  • added: class ECAlgorithm(Algorithm)
  • added: constructor ECAlgorithm(hash_alg)
  • added: field ECAlgorithm.SHA256
  • added: field ECAlgorithm.SHA384
  • added: field ECAlgorithm.SHA512
  • added: method ECAlgorithm.prepare_key(key)
  • added: method ECAlgorithm.sign(msg, key)
  • added: method ECAlgorithm.verify(msg, key, sig)
  • added: class RSAAlgorithm(Algorithm)
  • added: constructor RSAAlgorithm(hash_alg)
  • added: field RSAAlgorithm.SHA256
  • added: field RSAAlgorithm.SHA384
  • added: field RSAAlgorithm.SHA512
  • added: method RSAAlgorithm.prepare_key(key)
  • added: method RSAAlgorithm.sign(msg, key)
  • added: method RSAAlgorithm.verify(msg, key, sig)
  • changed: class InvalidTokenError(Exception) → class InvalidTokenError(PyJWTError)
  • added: class ImmatureSignatureError(InvalidTokenError)
  • added: class InvalidAlgorithmError(InvalidTokenError)
  • added: class InvalidIssuedAtError(InvalidTokenError)
  • added: class InvalidKeyError(PyJWTError)
  • added: class InvalidSignatureError(DecodeError)
  • added: class MissingRequiredClaimError(InvalidTokenError)
  • added: class PyJWTError(Exception)
  • added: constructor MissingRequiredClaimError(claim)
  • added: function info()
  • added: function main()
  • added: variable cryptography
  • added: variable ecdsa
  • added: function bytes_to_number(string)
  • added: function der_to_raw_signature(der_sig, curve)
  • added: function force_bytes(value)
  • added: function force_unicode(value)
  • added: function from_base64url_uint(val)
  • added: function merge_dict(original, updates)
  • added: function number_to_bytes(num, num_bytes)
  • added: function raw_to_der_signature(raw_sig, curve)
  • added: function to_base64url_uint(val)