golang-jwt 5

Apply these rules to github.com/golang-jwt/jwt/v5. This pack includes Go 1.27, whose token-verification rules also apply. This library signs and verifies compact JWTs; it does not supply a complete OAuth/OIDC flow, JWKS service, JWE implementation, or application authorization policy.

Parser configuration and header policy

• Construct a jwt.NewParser for each trusted issuer and token purpose, configure it before sharing, and keep the option slices and key lookup policy immutable during requests. WithValidMethods retains the supplied slice rather than copying it.
• Validate parser configuration at startup. A nil WithValidMethods slice leaves algorithm selection unrestricted, while a non-nil empty slice rejects every method; do not turn a missing algorithm configuration into a permissive default.
• Require the token profile's typ and any intended cty in a reviewed header check. The parser reads alg but does not impose token-purpose typing or implement critical extensions; reject unsupported crit, b64: false, compression, and nested/encrypted formats rather than treating them as ordinary signed JWTs.
• Keep custom signing-method registration fixed at startup. RegisterSigningMethod replaces the process-wide factory for an algorithm name, so an algorithm-name allowlist cannot protect against a substituted implementation. Never register a permissive verifier under a standard name.
• Keep shared SigningMethod instances, TimePrecision, and MarshalSingleStringAsArray unchanged during request handling. Use deliberate startup configuration instead of