RPError thrown when IdToken JWE Header enc is blank

[mikekellyio]

Describe the bug

When a Id Token with a JWE Header (below) is passed into decryptJWE, an error is thrown: RPError: unexpected JWE enc received, expected A128CBC-HS256, got: undefined

{
  "alg": "RS512"
  "kid": <kid value>
}

To Reproduce Issuer and Client configuration: (inline or gist) - Don't forget to redact your secrets.

// Client configuration (client.metadata) and how it is constructed (fromUri or manual?)
{
  client_id: <id>,
  client_secret: <secret>,
  id_token_encrypted_response_alg: "RS512",
  id_token_encrypted_response_enc: undefined,
  response_types: ["code"]
}

It appears that since there is a default value for expectedEnc, if header.enc is undefined an error will always be thrown. I am unable to find documentation in the RFC's suggesting that header.enc should be required, and I am running into this issue when integrating with PingFederate.

Steps to reproduce the behaviour:

1. Pass a token with the following header into decryptJWE

   {
   "alg": "RS512"
   "kid": <kid value>
   }

Expected behaviour No error is thrown.

Environment:

• openid-client version: 5.4.0
• node version: v16.16.0

Additional context Add any other context about the problem here.

• [x] the bug is happening on latest openid-client too.
• [x] i have searched the issues tracker on github for similar issues and couldn't find anything related.

[panva]

Your ID Tokens are not encrypted, you're setting encryption related properties though.

[mikekellyio]

I started to write an angry reply about how it was the open-id library calling this code so the problem had to be there somewhere, but in the process of staring harder at the openid-client code to find my evidence I fixed my problem. Leaving this in case someone else goes down this trail.

If I leave my client config without setting the alg, I get a different error.

// Client configuration (client.metadata) and how it is constructed (fromUri or manual?)
{
  client_id: <id>,
  client_secret: <secret>,
  response_types: ["code"]
}

results in: RPError: Unexpected JWT alg received, expected RS256, not RS512 in Client.validateJWT client.js:890.

My ultimate problem was that when reading the docs trying to figure out what config options to get past the above error, I chose the encrypted response ones rather than the signed response. Once I used id_token_signed_response_alg: "RS512" in my config, life got much better.