Validate claims if configured and verify_signature is not. (#608)

* Validate claims if configured.

* Remove secret and algorithm since we don't validate the signature.

* Add changelog.

1 files changed, 16 insertions, 0 deletions

diff --git a/tests/test_api_jwt.py b/tests/test_api_jwt.py
index f161763..05cb714 100644
--- a/tests/test_api_jwt.py
+++ b/tests/test_api_jwt.py
@@ -579,6 +579,22 @@ class TestJWT:
                 options={"verify_exp": True},
             )
 
+    def test_decode_with_verify_exp_option_and_signature_off(self, jwt, payload):
+        payload["exp"] = utc_timestamp() - 1
+        secret = "secret"
+        jwt_message = jwt.encode(payload, secret)
+
+        jwt.decode(
+            jwt_message,
+            options={"verify_signature": False},
+        )
+
+        with pytest.raises(ExpiredSignatureError):
+            jwt.decode(
+                jwt_message,
+                options={"verify_signature": False, "verify_exp": True},
+            )
+
     def test_decode_with_optional_algorithms(self, jwt, payload):
         secret = "secret"
         jwt_message = jwt.encode(payload, secret)