chore: JWT warnings on failed JWT ops

[peppelinux]

I'd like to have a warning meggase on failing JWT validations, or may use a debug for that and not a warning?

The messages must be improved.

actually with this PR we have

env/lib/python3.8/site-packages/idpyoidc/server/oidc/userinfo.py:191: KeyError
------------------------------------------------------------------------------------------------ Captured log call -------------------------------------------------------------------------------------------------
WARNING  cryptojwt.jwt:jwt.py:381 Exception unpacking a received signed or signed and encrypted Json Web Token for the issuer https://localhost:10000
WARNING  cryptojwt.jws.jws:jws.py:234 Exception "Invalid signature" caught

[codecov-commenter]

Codecov Report

Merging #124 (e27cd77) into main (d172218) will increase coverage by 0.14%.
The diff coverage is 95.65%.

@@            Coverage Diff             @@
##             main     #124      +/-   ##
==========================================
+ Coverage   77.26%   77.41%   +0.14%     
==========================================
  Files          41       42       +1     
  Lines        4324     4361      +37     
  Branches      836      843       +7     
==========================================
+ Hits         3341     3376      +35     
  Misses        718      718              
- Partials      265      267       +2     

Impacted Files	Coverage Δ
src/cryptojwt/jwt.py	76.30% <66.66%> (-0.59%)	⬇️
src/cryptojwt/jwe/fernet.py	97.36% <97.36%> (ø)
src/cryptojwt/jws/jws.py	80.87% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ec79b98...e27cd77. Read the comment docs.

[peppelinux]

did it, thank you

[peppelinux]

@jschlyter finally got tests working well but py36 seems stucked :)

[jschlyter]

@jschlyter finally got tests working well but py36 seems stucked :)

I think it is time to say goodbye to 3.6, see #128 - it was EOL over 6 months ago.

[peppelinux]

ok, so this is ready to be merged

[jschlyter]

I'm not sure it is a good idea to log the entire JWT on signature failures. I'd prefer if we the caller decides to do that. If an attacker submits a huge JWT for processing, ending up with it in log files (as a warning) is suboptimal.

One could include the JWT in the exception if that helps the caller. In that case we can defined a BadJwtSignature based on BadSignature that has a jwt attribute.

[rohe]

Good comment!

[peppelinux]

Ok, this PR will take more time and design

don't block the next release for this, we can leave as it is with the pending work to be completed and have the next release with the other PRs that are good right now