verify expects a specific jwtid?

[bencmbrook]

This module seems to expect the verifier to know what the "jti" is beforehand. I understand "jti" to be primarily used as a nonce to prevent replay attacks, or keeping a revocation list. The verify step, however, seems to just check that the provided jwtid matches a specific string.

"jti" reference

[bencmbrook]

I suppose this could act as a valid use-case, and it's good that if the option isn't passed, the token isn't rejected. Maybe it should just be documented that passing the option is only useful when you expect a specific jwtid?

[ziluvatar]

Yeah, probably not too useful, good catch, would you like to go ahead and document it clear for others?