By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

I can not find from jsonwebtoken.decode where it would throw:

• https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/decode.js#L3-L30

but it does return null, which was not checked.

The same goes for jws.decode, it returns null rather than throwing:

• https://github.com/auth0/node-jws/blob/master/lib/verify-stream.js#L57-L78

Checklist

• This change adds test coverage for new/changed/fixed functionality
• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch