current implementations of JWSVerifier doesn't allow having key id as a header parameter

[Former user]

current implementations of JWSVerifier only accept "alg", "typ" and "cty" header parameters. This doesn't allow having the "kid" header claim.

[Vladimir Dzhuvinov]

Thank you for reporting this. It's a known issue and I'm aiming to fix it early next month. It looks like we overdid header parameter checking :)

[Jason Reicheneker]

Does this error message mean I'm running into this issue?

Missing JSON object member with key "mod"

[Jason Reicheneker]

Please disregard my comment. It looks like I had a couple of nimbus-jose-jwt jar files in my classpath (v2.3 and v2.10.1).

[Jason Reicheneker]

Ok, now I've made it to the verification step and am seeing the same issue. Do you have an updated estimate when it will be fixed?

[Vladimir Dzhuvinov]

Fixed by commit a4fd2d0.

All reserved JWS header parameters, including kid are now accepted by default. To restrict the acceptable JWS algs or param names, or to allow custom parameters, do verifier.getJWSHeaderFilter() and call the appropriate setter methods.

Justin and I are working on adding JPSK support which should be complete this week and he'll then push an official release including this fix to Maven central.

[Jason Reicheneker]

Thank you very much. I entered #30 today after doing some more testing.