         }
         else {
             return false
+        }
+        // check whether alg parameter is on blacklist
+        let algorithm = header["alg"] as? String
+        for alg in self.blacklist {
+            if alg == algorithm {
+                return false
+            }
         }
         // decode the body (a URL-safe base 64 encoded JSON dict) from the 2nd part
         if parts.count > 1 {

public class JWT {
    // https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41#section-4
    // base class; supports alg: none, HS256, HS384, HS512
    var alg = "none"
    var header: [String: AnyObject] = ["alg": "none"] {
        // when header property is set directly, keep track of the "alg" field
        didSet {
            if let alg = header["alg"] as? String {
                self.alg = alg
            }
            else {
                self.alg = "none"   // if not present, handle (and insert) as alg: none
                self.header["alg"] = "none"
            }
        }
    }
    var body: [String: AnyObject] = [:]

    public init() {
        // defaults above are fine
    }

    public init(header: [String: AnyObject], body: [String: AnyObject]) {
        self.header = header
        self.body = body
        if let alg = header["alg"] as? String {
            self.alg = alg
        }
        else {
            self.alg = "none"   // if not present, handle (and insert) as alg: none
            self.header["alg"] = "none"
        }
    }


            // verify the signature, a URL-safe base64 encoded string
            let hdr_body: String = parts[0] + "." + parts[1] // header & body of a JWT
            let data = hdr_body.dataUsingEncoding(NSUTF8StringEncoding)!
            if self.verify_signature(data, signature: sig, algorithm: algorithm!, key: key) == false {
                return false // TODO: populate NSError
            }
            // verify content fields
            if self.verify_content() == false {
                return false
            }
        }
        return true
