One should always validate algorithm before doing anything with JWT on the server side.