Skip to content

Conversation

mathstuf
Copy link

@mathstuf mathstuf commented Oct 9, 2025

Headers may contain custom fields. As an example, these fields may be used by implementations to choose the decoding key rather than disabling signature validation, parsing the payload, determining the key and then decoding securely.

RFC 7519 § 5.3 explicitly calls out the ability to store iss, sub, and aud in the header.

Using custom structures also allows users to avoid storing any unnecessary data when doing such pre-processing.

See: https://datatracker.ietf.org/doc/html/rfc7519#section-5.3
Fixes: #435

Headers may contain custom fields. As an example, these fields may be
used by implementations to choose the decoding key rather than
disabling signature validation, parsing the payload, determining the key
and *then* decoding securely.

RFC 7519 § 5.3 explicitly calls out the ability to store `iss`, `sub`,
and `aud` in the header.

Using custom structures also allows users to avoid storing any
unnecessary data when doing such pre-processing.

See: https://datatracker.ietf.org/doc/html/rfc7519#section-5.3
Fixes: Keats#435
@mathstuf mathstuf mentioned this pull request Oct 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support for decoding with issuer-based decode keys

1 participant