Expand description
Read the claims out of a JWT without verifying it.
Two credential readers need the same thing: OpenAI’s auth.json and
Cursor’s state.vscdb both store an access token whose payload names the
account, and both want that name to label the vendor’s cache entry. Neither
verifies the signature — they are reading a token the local product already
obtained and trusts, not authenticating a caller — so this decodes the
payload segment and nothing more.
Because the claims are unverified, treat what comes out as untrusted input: it labels a cache entry and is sanitized like any other vendor-supplied text before it reaches a UI.
Functions§
- claims
- Decode a JWT’s payload segment.
Nonefor anything that is not three base64url segments wrapping JSON — a malformed token is not an error here, it just means there is no label to be had.