fix(jose): do not use header's jwk automatically

lepture · lepture · commit a5d4b2d4c9e4 · 2026-02-25T23:48:19.000+08:00
diff --git a/authlib/jose/rfc7515/jws.py b/authlib/jose/rfc7515/jws.py
@@ -269,8 +269,6 @@ def _prepare_algorithm_key(self, header, payload, key):
         algorithm = self.ALGORITHMS_REGISTRY[alg]
         if callable(key):
             key = key(header, payload)
-        elif key is None and "jwk" in header:
-            key = header["jwk"]
         key = algorithm.prepare_key(key)
         return algorithm, key
 
diff --git a/authlib/jose/rfc7516/jwe.py b/authlib/jose/rfc7516/jwe.py
@@ -754,6 +754,4 @@ def _validate_private_headers(self, header, alg):
 def prepare_key(alg, header, key):
     if callable(key):
         key = key(header, None)
-    elif key is None and "jwk" in header:
-        key = header["jwk"]
     return alg.prepare_key(key)
