def verify_jwt(jwt,<EOL>pub_key=None,<EOL>allowed_algs=None,<EOL>iat_skew=timedelta(),<EOL>checks_optional=False,<EOL>ignore_not_implemented=False):
if allowed_algs is None:<EOL><INDENT>allowed_algs = []<EOL><DEDENT>if not isinstance(allowed_algs, list):<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>header, claims, _ = jwt.split('<STR_LIT:.>')<EOL>parsed_header = json_decode(base64url_decode(header))<EOL>alg = parsed_header.get('<STR_LIT>')<EOL>if alg is None:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>if alg not in allowed_algs:<EOL><INDENT>raise _JWTError('<STR_LIT>' + alg)<EOL><DEDENT>if not ignore_not_implemented:<EOL><INDENT>for k in parsed_header:<EOL><INDENT>if k not in JWSHeaderRegistry:<EOL><INDENT>raise _JWTError('<STR_LIT>' + k)<EOL><DEDENT>if not JWSHeaderRegistry[k].supported:<EOL><INDENT>raise _JWTError('<STR_LIT>' + k)<EOL><DEDENT><DEDENT><DEDENT>if pub_key:<EOL><INDENT>token = JWS()<EOL>token.allowed_algs = allowed_algs<EOL>token.deserialize(jwt, pub_key)<EOL><DEDENT>elif '<STR_LIT:none>' not in allowed_algs:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>parsed_claims = json_decode(base64url_decode(claims))<EOL>utcnow = datetime.utcnow()<EOL>now = timegm(utcnow.utctimetuple())<EOL>typ = parsed_header.get('<STR_LIT>')<EOL>if typ is None:<EOL><INDENT>if not checks_optional:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT><DEDENT>elif typ != '<STR_LIT>':<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>iat = parsed_claims.get('<STR_LIT>')<EOL>if iat is None:<EOL><INDENT>if not checks_optional:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT><DEDENT>elif iat > timegm((utcnow + iat_skew).utctimetuple()):<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>nbf = parsed_claims.get('<STR_LIT>')<EOL>if nbf is None:<EOL><INDENT>if not checks_optional:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT><DEDENT>elif nbf > now:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>exp = parsed_claims.get('<STR_LIT>')<EOL>if exp is None:<EOL><INDENT>if not checks_optional:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT><DEDENT>elif exp <= now:<EOL><INDENT>raise _JWTError('<STR_LIT>')<EOL><DEDENT>return parsed_header, parsed_claims<EOL>
Verify a JSON Web Token.

:param jwt: The JSON Web Token to verify.
:type jwt: str or unicode

:param pub_key: The public key to be used to verify the token. Note: if you pass ``None`` and **allowed_algs** contains ``none`` then the token's signature will not be verified.
:type pub_key: `jwcrypto.jwk.JWK <https://jwcrypto.readthedocs.io/en/latest/jwk.html>`_

:param allowed_algs: Algorithms expected to be used to sign the token. The ``in`` operator is used to test membership.
:type allowed_algs: list or NoneType (meaning an empty list)

:param iat_skew: The amount of leeway to allow between the issuer's clock and the verifier's clock when verifiying that the token was generated in the past. Defaults to no leeway.
:type iat_skew: datetime.timedelta

:param checks_optional: If ``False``, then the token must contain the **typ** header property and the **iat**, **nbf** and **exp** claim properties.
:type checks_optional: bool

:param ignore_not_implemented: If ``False``, then the token must *not* contain the **jku**, **jwk**, **x5u**, **x5c** or **x5t** header properties.
:type ignore_not_implemented: bool

:rtype: tuple
:returns: ``(header, claims)`` if the token was verified successfully. The token must pass the following tests:

- Its header must contain a property **alg** with a value in **allowed_algs**.
- Its signature must verify using **pub_key** (unless its algorithm is ``none`` and ``none`` is in **allowed_algs**).
- If the corresponding property is present or **checks_optional** is ``False``:

  - Its header must contain a property **typ** with the value ``JWT``.
  - Its claims must contain a property **iat** which represents a date in the past (taking into account :obj:`iat_skew`).
  - Its claims must contain a property **nbf** which represents a date in the past.
  - Its claims must contain a property **exp** which represents a date in the future.

:raises: If the token failed to verify.