Summary
JWT::Token#detach_payload! sets the detached flag but does not invalidate an already rendered @jwt, so call order changes the result.
Reproduction
token = JWT::Token.new(payload: { data: 'value' })
token.sign!(algorithm: 'HS256', key: 'secret')
attached = token.jwt
token.detach_payload!
raise if token.jwt == attachedOn 3.2.0/current behavior, the final call returns the cached attached token. Clearing @jwt when detaching makes the payload segment empty as requested.
Verification
A source-only candidate passes the focused failing/passing model, the 554-example release suite (12 expected OpenSSL 3 pending), focused RuboCop, gem build and Rails 8.1.3.1 JWT integration. No repository tests or changelog were changed during the audit, so this is issue-first for the contribution policy.
Prepared with AI-assisted source review.
Summary
JWT::Token#detach_payload!sets the detached flag but does not invalidate an already rendered@jwt, so call order changes the result.Reproduction
On 3.2.0/current behavior, the final call returns the cached attached token. Clearing
@jwtwhen detaching makes the payload segment empty as requested.Verification
A source-only candidate passes the focused failing/passing model, the 554-example release suite (12 expected OpenSSL 3 pending), focused RuboCop, gem build and Rails 8.1.3.1 JWT integration. No repository tests or changelog were changed during the audit, so this is issue-first for the contribution policy.
Prepared with AI-assisted source review.