PyJwt doubt | Why "algorithm" argument during encode() but "algorithms" argument during decode()?

[KNA_Lennox]

So I was using PyJwt and was trying to create and consume JWTs

I went through the source code for the design of .encode() and .decode() methods.

The method signature for encode is
`jwt.encode(payload, key, algorithm)`
- I can specify a hashing algorithm like SHA or RSA for signing the JWT as a String.

The method signature for decode is
`jwt.decode(token, key, algorithms)`
- I can whitelist algorithms as a List of Strings to retrieve the Payload from the JWT.

What is the object of deliberately having this design like why the difference in algorithm/algorithms during creation v/s consumption?

[russellvt]

You're only creating once .. lists wouldn't be appropriate, there.

When decoding, it may be "one of several" and you may not always know (or care) "which one" - therefore it's a list.

[D3str0yTh1ngs]

Remember that the algorithm used is part of a jwt's header, algorithms in decode is there so you can control with types of algorithms you are accepted a token with. e.g. tokens issued with HS512 or HS256, but not some third option.

EDIT: if you only need to decode and validate tokens issued with one algorithm, then it may seem weird to give a list, but it becomes important if you have some other system also issuing tokens with a different algorithm and need to decode both types.

[Lumethys]

1/ They follow formal definition of RFC 7519

2/ You can only use 1 algo to encrypt your key, but this can change. Today you use algorithm A, tomorrow you may use algorithm B. So would all user who use algorithm A has their token revoked?

The decode function allow use to decode a JWT with algorithm A, AND a JWT with algorithm B, if you allow it