Makes the 'typ' header truly optionnal

[olinox14]

JWT specifications statues that the 'typ' header is optional. However, the JWT::encode method automatically add the header, and doesn't provide any option to remove it.

I'm currently stuck because, for an unknown reason, the Mercure hub (written in GO and using jwt-go to parse the jwt) throw an 'invalid signature' error whenever the 'typ' header is added. I submitted an issue on their github too, but I still think it could be useful to be able to completely override the header of a JWT.

[bshaffer]

I am not sure I understand your ask. Just because it's optional in the JWT spec doesn't mean this library shouldn't always set it. Unless there is a specific bug with this library you'd like to report, there's nothing I can do here.

[olinox14]

I encountered a difficult problem with mercure, and the only difference I found at this time between the working update and the non-working one was the header. After some hours, I finally understood that the problem was caused by something else (involving some symfony cache not being correctly cleared).

Fact is, I would have gained some time if I have been able to setup the header of the JWT, and having total control on it, I would have been able to innocent the 'typ' header quicker. It's not a bug, but this could be a feature, and it would be coherent with the specs.

[bshaffer]

I don't disagree that we could open up options for more header control. We do offer the $head parameter for custom header values, but it unfortunately cannot be used to override the pre-populated values of typ and alg (for security reasons).

If the reason you needed it was for debugging purposes, I do not think it merits a change to the library (which could potentially open up a security hole). However, we are always open to suggestions! That's what Open Source is all about!

I'm closing this because it's too broad, but please create a new issue with a more specific ask if you have an idea of how to implement better header control without sacrificing security.

[bshaffer]

The "typ" header is now able to be overwritten using the $head parameter as of v6.10.0. Note that supplying "alg" in the $head parameter will still not have an effect, as the required $alg parameter takes precedence.