JWT algorithm not validated

Code reviewCode quality & reviewMid–Senior~25 min

Review this Go JWT validation helper.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1func parseClaims(tokenStr string, secret []byte) (jwt.MapClaims, error) {

2 token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {

3 return secret, nil

4 })

5 if err != nil {

6 return nil, err

7 }

8 if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {

9 return claims, nil

10 }

11 return nil, errors.New("invalid claims")

12}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.