JWT Invalid Signature

jwt_invalid_sig.rb

require "jwt"
SIGNING_SECRET = 'jwtsigningsecret'
ALGORITHM = 'HS512'

# Suppose a sender wants to send the following payload
transfer_50_payload = { transfer_amt: 50 }

token_legit = JWT.encode payload, SIGNING_SECRET, ALGORITHM
# eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJ0cmFuc2Zlcl9hbXQiOiI1MCJ9.tf8g0nTprdIzoqLVrjLJS5bYFysiLYal8o4OeBbOuebU1UxGdKYhtADLD2oLzO_P2QmZBFqsF7uAAaN3DvYYAw

# But a hacker alters that payload
transfer_500_payload = { transfer_amt: 500 }
token_500 = JWT.encode payload_altered, SIGNING_SECRET, ALGORITHM

# The hacker injects the new payload into the original token
token_altered = [token_legit.split(".").first, token_500.split(".")[1], token_legit.split(".").last].join(".")

JWT.decode token_altered, SIGNING_SECRET, true: { algorithm: ALGORITHM }

# JWT will know that the payload has been altered.
JWT::VerificationError: Signature verification raised