myartsev / ember-simple-auth-jwt

Ember Simple Auth extension for JWT
MIT License
8 stars 3 forks source link

Update token validation to remove checking the JWT header for a 'typ' claim #14

Closed myartsev closed 6 years ago

myartsev commented 6 years ago

Per JWT spec, the typ claim in the JWT header is optional:

3.1 The Header Every JWT carries a header (also known as the JOSE header) with claims about itself. These claims establish the algorithms used, whether the JWT is signed or encrypted, and in general, how to parse the rest of the JWT. According to the type of JWT in question, more fields may be mandatory in the header. For instance, encrypted JWTs carry information about the cryptographic algorithms used for key encryption and content encryption. These fields are not present for unencrypted JWTs. The only mandatory claim for an unencrypted JWT header is the alg claim: • alg: the main algorithm in use for signing and/or decrypting this JWT. For unencrypted JWTs this claim must be set to the value none. Optional header claims include the typ and cty claims: • typ: the media type5 of the JWT itself. This parameter is only meant to be used as a help for uses where JWTs may be mixed with other objects carrying a JOSE header. In practice, this rarely happens. When present, this claim should be set to the value JWT. ...