I'm trying to add support for KMS while keeping the header {"alg": "RS256"}. We found a workaround but would like some opinion on how to make it easier to follow.
Expected Result
To be able to add a custom algorithm that defines the expected header.
Allow us to override the header when calling jwt: (you may have a better idea)
jwt.register_algorithm("KMS-RS256", AWSKMSAlgorithm())
jwt_token = jwt.encode(payload, key=key_id, algorithm="KMS-RS256", header={"alg":"RS256"})
# jwt_token is created using `AWSKMSAlgorithm` and header has `{"alg":"RS256"}`
decoded = jwt.decode(jwt_token, key=key_id, algorithms=["KMS-RS256"], header={"alg":"RS256"})
# jwt_token is decoded using `AWSKMSAlgorithm` and header is validated with `{"alg":"RS256"}`
I'm happy to create a PR allowing algorithm to be different than header: {"alg"} when both are defined.
Actual Result
The header "alg" is enforced to the same algorithm used to load the expected implementation, with no way to change it.
A workaround was to unregister the default RS256 algorithm, register my custom algorithm, decode/encode, and then undo my change. This is less than ideal as we are changing a global state, which could result in race conditions.
I'm trying to add support for KMS while keeping the header
{"alg": "RS256"}
. We found a workaround but would like some opinion on how to make it easier to follow.Expected Result
To be able to add a custom algorithm that defines the expected header.
Allow us to override the header when calling jwt: (you may have a better idea)
With the current implementation, there's no option to enforce a header, when the header "alg" is set, the parameter
algorithm
is ignored. When the header is not set,algorithm
is used as "alg" in the header.I'm happy to create a PR allowing
algorithm
to be different thanheader: {"alg"}
when both are defined.Actual Result
The header "alg" is enforced to the same algorithm used to load the expected implementation, with no way to change it.
A workaround was to unregister the default
RS256
algorithm, register my custom algorithm, decode/encode, and then undo my change. This is less than ideal as we are changing a global state, which could result in race conditions.Reproduction Steps
System Information