jwt.encode() overrides the algorithm specified by the caller

[hiranya911]

The jwt.encode() function always set the alg JWT header to either ES256 or RS256, even if the caller had specified an explicit algorithm:

google-auth-library-python/google/auth/jwt.py

Lines 98 to 101 in 48e8be3

	if es256 is not None and isinstance(signer, es256.ES256Signer):
	header.update({"alg": "ES256"})
	else:
	header.update({"alg": "RS256"})

This function should only set the alg header when the caller hasn't specified one. This is required to support some use cases in Firebase emulator, where we need the ability to mint JWTs with alg header values like none.

[hiranya911]

It might also make sense to read the exact alg header to use from the google.auth.crypt.Signer interface, since those concepts are close related. Something like:

if 'alg' not in header:
    if signer.alg:
        header['alg'] = signer.alg
    elif es256 is not None and isinstance(signer, es256.ES256Signer): 
       header.update({"alg": "ES256"}) 
    else: 
       header.update({"alg": "RS256"})

Let me know if this makes sense, and I'd be happy to provide a PR to this effect.

[busunkim96]

@arithmetic1728 @silvolu PTAL

[hiranya911]

Also adding @yuchenshi and @samtstern from Firebase for visibility.

[arithmetic1728]

@hiranya911 I created a PR to use alg from header if provided.