def jwt_decode_handler(token, get_api_key=APIKey.get_jwt_key):
    # If you raise AuthenticationFailed from this method, its value will
    # be displayed to the client. Be careful not to reveal anything
    # sensitive. When you raise other exceptions, the user will see
    # a generic failure message.
    token_data = jwt.decode(token, verify=False)
    if 'iss' not in token_data:
        log.info('No issuer in JWT auth token: {}'.format(token_data))
        raise exceptions.AuthenticationFailed(
            detail='JWT iss (issuer) claim is missing.')

    try:
        api_key = get_api_key(key=token_data['iss'])
    except ObjectDoesNotExist, exc:
        log.info('No API key for JWT issuer: {}'.format(token_data['iss']))
        raise exceptions.AuthenticationFailed(
            detail='Unknown JWT iss (issuer).')

    # TODO: add nonce checking to prevent replays. bug 1213354.

    options = {
        'verify_signature': True,
        'verify_exp': True,
        'verify_nbf': False,
        'verify_iat': True,
        'verify_aud': False,
        'require_exp': True,
        'require_iat': True,
        'require_nbf': False,
    }
    try:
        payload = jwt.decode(
            token,
            api_key.secret,
            verify=True,
            options=options,
            leeway=api_settings.JWT_LEEWAY,
            algorithms=[api_settings.JWT_ALGORITHM]
        )
    except jwt.MissingRequiredClaimError, exc:
        log.info(u'Missing required claim during JWT authentication: '
                 u'{e.__class__.__name__}: {e}'.format(e=exc))
        raise exceptions.AuthenticationFailed(
            detail=u'Invalid JWT: {}.'.format(exc))
    except jwt.InvalidIssuedAtError, exc:
        log.info(u'Invalid iat during JWT authentication: '
                 u'{e.__class__.__name__}: {e}'.format(e=exc))
        raise exceptions.AuthenticationFailed(
            detail='JWT iat (issued at time) is invalid. Make sure your '
                   'system clock is synchronized with something like TLSdate.')
    except Exception, exc:
        log.warning(u'Unhandled exception during JWT authentication: '
                    u'{e.__class__.__name__}: {e}'.format(e=exc))
        raise

    max_jwt_auth_token_lifetime = settings.MAX_APIKEY_JWT_AUTH_TOKEN_LIFETIME
    if payload['exp'] - payload['iat'] > max_jwt_auth_token_lifetime:
        log.info('JWT auth: expiration is too long; '
                 'iss={iss}, iat={iat}, exp={exp}'.format(**payload))
        raise exceptions.AuthenticationFailed(
            detail='JWT exp (expiration) is too long.')

    return payload
Decodes a JWT token.
dataset/ETHPy150Open mozilla/addons-server/src/olympia/api/jwt_auth.py/jwt_decode_handler