feat: Adds support for multiple decode algorithms

[Darkheir]

Sometimes we may need to support to decode tokens coming from multiple algorithms (for example when making the switch from one to another).

This PR aims to allow the user to specify a list of supported algorithms to decode a token by setting the JWT_DECODE_ALGORITHMS key.

If the key is not specified it will fallback on what has been set in JWT_ALGORITHM to keep the current way of doing.

[pep8speaks]

Hello @Darkheir! Thanks for updating this PR. We checked the lines you've touched for PEP 8 issues, and found:

There are currently no PEP 8 issues detected in this Pull Request. Cheers! 🍻

Comment last updated at 2019-06-24 19:46:02 UTC

[coveralls]

Coverage remained the same at 100.0% when pulling 4ab4234 on Darkheir:feat/multiple_decode_algorithms into 23584dd on vimalloc:master.

[vimalloc]

Looks great!

Long term with this change I think it would make sense to depreciate JWT_ALGORITHM entirely, and instead have JWT_DECODE_ALGORITHMS and JWT_ENCODE_ALGORITHM options, but I don't think the benefit of doing that right now would be worth the breaking change it would cause. If I ever need to make another breaking change to this extension though, I'll try to include that change as well.

Thanks for contributing! I'll get a new release cut with this soon 👍

[vimalloc]

Released in 3.19.0. Cheers!

[Darkheir]

Thank you so much for the quick release!

Just as a side note, the solution will not work as it is if the decode key changed (switched from a symmetric algorithm to an asymmetric one, different key, ...).
To support it the decode key callback must be set. I didn't implement it in the PR because it may vary a lot depending on the use case.

[vimalloc]

I think that’s appropriate. Like you mentioned, the decode key callback should be able to be used to handle the key changing in these situations. Here is a link to that callback, in case someone else looks at this thread in the future: https://flask-jwt-extended.readthedocs.io/en/latest/api.html#flask_jwt_extended.JWTManager.decode_key_loader

Cheers 👍

[nirgilboa]

I'm using this feature and it works nicely :) so thank you!

Suggest to make a note regarding the callback on the page documenting the options: https://flask-jwt-extended.readthedocs.io/en/stable/options/