Summary
Replacing JWT::EncodedToken#encoded_payload leaves the old decoded payload cached and preserves successful signature/claims verification flags.
Reproduction
Construct and verify an encoded token, read payload, then assign a different encoded payload. The current object continues exposing the old verified payload without re-verification. A setter that clears @decoded_payload, @signature_verified, and @claims_verified makes subsequent payload access require verification against the new signing input.
Verification
A source-only candidate passes the focused failing/passing state model, the 554-example release suite (12 expected OpenSSL 3 pending), focused RuboCop, gem build and Rails 8.1.3.1 JWT integration. It also removes the now-redundant private unencoded parse wrapper to keep class-size lint unchanged. No repository tests or changelog were changed during the audit, so this is issue-first for the contribution policy.
Prepared with AI-assisted source review.
Summary
Replacing
JWT::EncodedToken#encoded_payloadleaves the old decoded payload cached and preserves successful signature/claims verification flags.Reproduction
Construct and verify an encoded token, read
payload, then assign a different encoded payload. The current object continues exposing the old verified payload without re-verification. A setter that clears@decoded_payload,@signature_verified, and@claims_verifiedmakes subsequent payload access require verification against the new signing input.Verification
A source-only candidate passes the focused failing/passing state model, the 554-example release suite (12 expected OpenSSL 3 pending), focused RuboCop, gem build and Rails 8.1.3.1 JWT integration. It also removes the now-redundant private unencoded parse wrapper to keep class-size lint unchanged. No repository tests or changelog were changed during the audit, so this is issue-first for the contribution policy.
Prepared with AI-assisted source review.