twilio · eshanholtz · Sep 22, 2021 · Feb 4, 2021 · Feb 4, 2021 · Feb 15, 2021
diff --git a/requirements.txt b/requirements.txt
@@ -3,5 +3,5 @@ mock
 nose
 six
 requests>=2.0.0
-PyJWT==1.7.1
-twine
+PyJWT>=2.0.0, <3.0.0
+twine
diff --git a/setup.py b/setup.py
@@ -27,7 +27,7 @@
     install_requires=[
         "six",
         "pytz",
-        "PyJWT == 1.7.1",
+        "PyJWT >= 2.0.0, < 3.0.0",
     ],
     extras_require={
         ':python_version<"3.0"': [

diff --git a/tests/unit/jwt/test_jwt.py b/tests/unit/jwt/test_jwt.py
@@ -43,7 +43,7 @@ def assertJwtsEqual(self, jwt, key, expected_payload=None, expected_headers=None
         expected_headers = expected_headers or {}
         expected_payload = expected_payload or {}
 
-        decoded_payload = jwt_lib.decode(jwt, key, verify=False)
+        decoded_payload = jwt_lib.decode(jwt, key, algorithms=["HS256"], options={"verify_signature": False})
         decoded_headers = jwt_lib.get_unverified_header(jwt)
 
         self.assertEqual(expected_headers, decoded_headers)
@@ -242,9 +242,8 @@ def test_decode_bad_secret(self):
 
     def test_decode_modified_jwt_fails(self):
         jwt = DummyJwt('secret_key', 'issuer')
-        example_jwt = jwt.to_jwt().decode('utf-8')
+        example_jwt = jwt.to_jwt()
         example_jwt = 'ABC' + example_jwt[3:]
-        example_jwt = example_jwt.encode('utf-8')
 
         self.assertRaises(JwtDecodeError, Jwt.from_jwt, example_jwt, 'secret_key')
 

diff --git a/twilio/jwt/__init__.py b/twilio/jwt/__init__.py
@@ -140,7 +140,8 @@ def from_jwt(cls, jwt, key=''):
         verify = True if key else False
 
         try:
-            payload = jwt_lib.decode(bytes(jwt), key, options={
+            alg = jwt_lib.get_unverified_header(jwt).get("alg", "HS256")
+            payload = jwt_lib.decode(jwt, key, algorithms=[alg], options={
                 'verify_signature': verify,
                 'verify_exp': True,
                 'verify_nbf': True,