Verify JWT header format

CHANGELOG.md

@@ -11,6 +11,7 @@
 **Fixes and enhancements:**
 
 - Updated README to correctly document `OpenSSL::HMAC` documentation [#617](https://github.com/jwt/ruby-jwt/pull/617) ([@aedryan](https://github.com/aedryan))
+- Verify JWT header format [#622](https://github.com/jwt/ruby-jwt/pull/622) ([@304](https://github.com/304))
 - Your contribution here
 
 ## [v2.9.1](https://github.com/jwt/ruby-jwt/tree/v2.9.1) (2024-09-23)

lib/jwt/decode.rb

@@ -49,6 +49,7 @@ def verify_signature
 
     def verify_algo
       raise JWT::IncorrectAlgorithm, 'An algorithm must be specified' if allowed_algorithms.empty?
+      raise JWT::DecodeError, 'Token header not a JSON object' unless header.is_a?(Hash)
       raise JWT::IncorrectAlgorithm, 'Token is missing alg header' unless alg_in_header
       raise JWT::IncorrectAlgorithm, 'Expected a different algorithm' if allowed_and_valid_algorithms.empty?
     end

spec/jwt/jwt_spec.rb

@@ -7,6 +7,7 @@
     data = {
       :empty_token => 'e30K.e30K.e30K',
       :empty_token_2_segment => 'e30K.e30K.',
+      :invalid_header_token => 'W10.e30K.e30K',
       :secret => 'My$ecretK3y',
       :rsa_private => test_pkey('rsa-2048-private.pem'),
       :rsa_public => test_pkey('rsa-2048-public.pem'),
@@ -520,6 +521,14 @@
           end.to raise_error JWT::IncorrectAlgorithm
         end
 
+        context 'invalid header format' do
+          it 'should raise JWT::DecodeError' do
+            expect do
+              JWT.decode data[:invalid_header_token]
+            end.to raise_error JWT::DecodeError
+          end
+        end
+
         context '2-segment token' do
           it 'should raise JWT::IncorrectAlgorithm' do
             expect do