allow spec violating lower case type in the JOSEHeader

core/src/main/kotlin/io/github/nefilim/kjwt/JWT.kt

@@ -35,7 +35,7 @@ fun String?.toJWTKeyID(): JWTKeyID? = this?.let { JWTKeyID(it)}
 @Serializable
 data class JOSEHeader<T: JWSAlgorithm>(
     @SerialName("alg") @Serializable(JWSAlgorithmSerializer::class) val algorithm: T,
-    @SerialName("typ") val type: JOSEType,
+    @SerialName("typ") @Serializable(JOSETypeSerializer::class) val type: JOSEType,
     @SerialName("kid") val keyID: JWTKeyID? = null,
 ) {
     fun toJSON(): String {

core/src/main/kotlin/io/github/nefilim/kjwt/Serializers.kt

@@ -27,4 +27,20 @@ object JWSAlgorithmSerializer: KSerializer<JWSAlgorithm> {
     }
 
     override val descriptor: SerialDescriptor = PrimitiveSerialDescriptor("JWSAlgorithm", PrimitiveKind.STRING)
+}
+
+@OptIn(ExperimentalSerializationApi::class)
+@Serializer(forClass = JWSAlgorithm::class)
+object JOSETypeSerializer: KSerializer<JOSEType> {
+
+    override fun deserialize(decoder: Decoder): JOSEType {
+        val typ = decoder.decodeString().trim().uppercase()
+        return JOSEType.valueOf(typ)
+    }
+
+    override fun serialize(encoder: Encoder, value: JOSEType) {
+        encoder.encodeString(value.id)
+    }
+
+    override val descriptor: SerialDescriptor = PrimitiveSerialDescriptor("JOSEType", PrimitiveKind.STRING)
 }

core/src/test/kotlin/io/github/nefilim/kjwt/JWTSpec.kt

@@ -1,6 +1,7 @@
 package io.github.nefilim.kjwt
 
 import arrow.core.ValidatedNel
+import arrow.core.getOrElse
 import arrow.core.some
 import com.nimbusds.jose.crypto.ECDSAVerifier
 import com.nimbusds.jose.crypto.MACVerifier
@@ -34,6 +35,7 @@ import mu.KotlinLogging
 import java.time.Instant
 import java.time.LocalDateTime
 import java.time.ZoneId
+import java.time.ZoneOffset
 import com.nimbusds.jwt.SignedJWT as NimbusSignedJWT
 
 class JWTSpec: WordSpec() {
@@ -106,6 +108,34 @@ class JWTSpec: WordSpec() {
                 JWT.decodeT(signedJWT.rendered, JWSRSA256Algorithm).shouldBeLeft(KJWTVerificationError.AlgorithmMismatch)
             }
 
+            "decode spec violating types" {
+                val rawJWT = es256 {
+                    subject("1234567890")
+                    issuedAt(LocalDateTime.ofInstant(Instant.ofEpochSecond(1516239022), ZoneId.of("UTC")))
+                }
+                // create a token with a spec violating lowercase type of "jwt"
+                val jwtString = listOf(
+                    """
+                        {
+                            "alg": "${rawJWT.header.algorithm.headerID}",
+                            "typ": "jwt" 
+                        }
+                    """.trimIndent(),
+                    """
+                        {
+                            "sub": "${rawJWT.subject().getOrElse { "" }}",
+                            "iat": ${rawJWT.issuedAt().map { it.toEpochSecond(ZoneOffset.UTC) }.getOrElse { 0 }}
+                        }
+                    """.trimIndent()
+                ).joinToString(".") {
+                    jwtEncodeBytes(it.toByteArray(Charsets.UTF_8))
+                }
+                JWT.decode(jwtString).shouldBeRight().also {
+                    it.parts.size shouldBe 2
+                    it.jwt shouldBe rawJWT
+                }
+            }
+
             "support arbitrary JSON claim values" {
                 val thelist = listOf("tagA", "tagB", "tagC")
                 val rawJWT = es256 {

gradle/libs.versions.toml

@@ -1,7 +1,7 @@
 [versions]
 kotlin = "1.6.21"
-kotlinXCoroutines = "1.6.1"
-kotlinXSerialization = "1.3.2"
+kotlinXCoroutines = "1.6.4"
+kotlinXSerialization = "1.4.1"
 
 # third party
 arrow = "1.0.1"