Allow validating JWT against JWKS without kid

jwt/jwks_client.py

@@ -87,15 +87,15 @@
         signing_keys = [
             jwk_set_key
             for jwk_set_key in jwk_set.keys
-            if jwk_set_key.public_key_use in ["sig", None] and jwk_set_key.key_id
+            if jwk_set_key.public_key_use in ["sig", None]
         ]
 
         if not signing_keys:
             raise PyJWKClientError("The JWKS endpoint did not contain any signing keys")
 
         return signing_keys
 
-    def get_signing_key(self, kid: str) -> PyJWK:
+    def get_signing_key(self, kid: Optional[str]) -> PyJWK:
         signing_keys = self.get_signing_keys()
         signing_key = self.match_kid(signing_keys, kid)
 
@@ -114,10 +114,15 @@
     def get_signing_key_from_jwt(self, token: str | bytes) -> PyJWK:
         unverified = decode_token(token, options={"verify_signature": False})
         header = unverified["header"]
-        return self.get_signing_key(header.get("kid"))
+        return self.get_signing_key(header.get("kid", None))
 
     @staticmethod
-    def match_kid(signing_keys: List[PyJWK], kid: str) -> Optional[PyJWK]:
+    def match_kid(signing_keys: List[PyJWK], kid: Optional[str]) -> Optional[PyJWK]:
+        if kid is None:
+            if len(signing_keys) == 1:
+                return signing_keys[0]
+            else:
+                return None
         signing_key = None
 
         for key in signing_keys: