Preserve claims verification state for unencoded payloads

Author: OskarEichler

CHANGELOG.md

@@ -10,6 +10,7 @@
 
 **Fixes and enhancements:**
 
+- Preserve claims verification state and reject unsupported critical headers when decoding unencoded payloads [#753](https://github.com/jwt/ruby-jwt/pull/753) - [@OskarEichler](https://github.com/OskarEichler)
 - Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip [#728](https://github.com/jwt/ruby-jwt/pull/728)
 - Fix the `Style/DirectiveScope` RuboCop offense failing the build [#752](https://github.com/jwt/ruby-jwt/pull/752)
 

lib/jwt/claims/crit.rb

@@ -7,8 +7,10 @@ class Crit
       # Initializes a new Crit instance.
       #
       # @param expected_crits [String] the expected crit header values for the JWT token.
-      def initialize(expected_crits:)
+      # @param strict [Boolean] whether the crit header may contain only expected values.
+      def initialize(expected_crits:, strict: false)
         @expected_crits = Array(expected_crits)
+        @strict = strict
       end
 
       # Verifies the critical claim ('crit') in the JWT token header.
@@ -24,12 +26,15 @@ def verify!(context:, **_args)
         missing = (expected_crits - context.header['crit'])
         raise(JWT::InvalidCritError, "Crit header missing expected values: #{missing.join(', ')}") if missing.any?
 
+        unexpected = (context.header['crit'] - expected_crits)
+        raise(JWT::InvalidCritError, "Unsupported critical headers: #{unexpected.join(', ')}") if strict && unexpected.any?
+
         nil
       end
 
       private
 
-      attr_reader :expected_crits
+      attr_reader :expected_crits, :strict
     end
   end
 end

lib/jwt/encoded_token.rb

@@ -190,7 +190,7 @@ def decode_payload
       raise JWT::DecodeError, 'Encoded payload is empty' if encoded_payload == ''
 
       if unencoded_payload?
-        verify_claims!(crit: ['b64'])
+        Claims::Crit.new(expected_crits: ['b64'], strict: true).verify!(context: ClaimsContext.new(self))
         return parse_unencoded(encoded_payload)
       end