plugins/jwt_decoder.lua:58

• decode_jwt_payload decodes attacker-controlled header values without any size limits. A large header that matches the JWT shape can cause large allocations (base64 decode + decoded string) and can also create an oversized outbound X-JWT-Decoded-* header that may break forwarding through proxies/servers with header-size limits.

Consider bounding the work and skipping decoding when the token/payload/decoded JSON exceeds a reasonable limit (e.g., 8KB).

local function decode_jwt_payload(value)
	-- Three dot-separated base64url segments; the signature may be empty (alg:none).
	local payload = value:match("^[A-Za-z0-9_-]+%.([A-Za-z0-9_-]+)%.[A-Za-z0-9_-]*$")
	if not payload then
		return nil

plugins/jwt_decoder.lua:51

• b64url_decode currently accepts inputs with non-zero leftover bits (i.e., invalid base64url when unpadded). That can decode malformed payload segments and increases the chance of false positives (or inconsistent decoding) when scanning arbitrary header values.

Consider rejecting inputs where leftover bits remain and are not all zero.

	end
	return table.concat(out)
end

plugins/jwt_decoder.lua:48

• b64url_decode only emits a single byte when bits >= 8. Because base64url adds 6 bits per character, bits can exceed 16 and should emit multiple bytes per iteration; using if here produces incorrect decoding for most inputs (and can lead to invalid byte values passed to string.char).

		if bits >= 8 then
			bits = bits - 8
			out[#out + 1] = string.char(math.floor(acc / 2 ^ bits))
			acc = acc % 2 ^ bits
		end

plugins/jwt_decoder.lua:59

• The PR description says the signature segment is optional for alg:none, but the current pattern requires a trailing . (i.e., always 3 segments). If you want to support 2-segment tokens (header.payload) as well, the match needs to allow that form.

	-- Three dot-separated base64url segments; the signature may be empty (alg:none).
	local payload = value:match("^[A-Za-z0-9_-]+%.([A-Za-z0-9_-]+)%.[A-Za-z0-9_-]*$")
	if not payload or #payload > 8192 then
		return nil
	end