If KeyId is empty, do not include it in the header.

paulquerna-okta · paulquerna-okta · commit 5fc046e0fe22 · 2019-04-15T17:15:49.000-07:00
diff --git a/signing.go b/signing.go
@@ -233,7 +233,10 @@ func (ctx *genericSigner) Sign(payload []byte) (*JSONWebSignature, error) {
 			if ctx.embedJWK {
 				protected[headerJWK] = recipient.publicKey()
 			} else {
-				protected[headerKeyID] = recipient.publicKey().KeyID
+				keyID := recipient.publicKey().KeyID
+				if keyID != "" {
+					protected[headerKeyID] = keyID
+				}
 			}
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -233,7 +233,10 @@ func (ctx genericSigner) Sign(payload []byte) (JSONWebSignature, error) {`
`233`	`233`	`if ctx.embedJWK {`
`234`	`234`	`protected[headerJWK] = recipient.publicKey()`
`235`	`235`	`} else {`
`236`		`- protected[headerKeyID] = recipient.publicKey().KeyID`
	`236`	`+ keyID := recipient.publicKey().KeyID`
	`237`	`+ if keyID != "" {`
	`238`	`+ protected[headerKeyID] = keyID`
	`239`	`+ }`
`237`	`240`	`}`
`238`	`241`	`}`
`239`	`242`