Question: Why use python-jose over pyjwt?

[sirosen]

It would be nice to have a section of the readme dedicated to explaining why one might use this project instead of pyjwt, especially since it says it was based on pyjwt. This seems particularly salient since pyjwt has a larger community of contributors.

My team started using python-jose because it supports using JWKs to validate JWTs. At the time, pyjwt did not support JWKs.
However, since that time, pyjwt has added this feature, and I'm no longer sure which one is the right choice for us.

[fgblomqvist]

I second this. Worth noting is that PyJWT's JWK support is undocumented (afaik).
Also worth noting is the remarks that PyJWT has on this page:
https://jwt.io/
According to that page, PyJWT fails to check 2 things in the token (for security).

[edmorley]

Friendly ping? :-)

[sirosen]

Worth sharing: pyjwt does not support verification of the OIDC at_hash, nor does it easily expose a way to validate it.
(The hash algorithm needs to be easy to access / invoke for this to work well).

So if you're working with OIDC, python-jose might appeal for that reason.
Our team is using both pyjwt and python-jose, in different projects.

[AbdusamadAbdullaxanov]

well, it sounds understandable, now I am confidently decided to learn JWT with 'python-jose'. Thanks for explanation

[twwildey]

In my limited experience, python-jose offers a more comprehensive suite of algorithms when compared to PyJWT. This is a primary reason to use this package.

[scorpp]

latest release of python-jose dates back to 2021 and has number of security issues that exist for years https://security.snyk.io/package/pip/python-jose

[geo7]

@scorpp thanks for noting - they seem to be fixed now looking at that link.

I think the original comment still stands though, given the README states:

> This library was originally based heavily on the work of the folks over at PyJWT.

It would be appreciated if there was an outline from @mpdavis on why jose might be more suitable than jwt to some projects :) especially as there's some confusion here #359 on whether the project is active (given recent commits / releases I assume the issue linked is wrong).