Fix "typ" header value in NimbusJwtEncoder-encoded JWT

ziqin · jzheaux · commit 1d1b3ff797b5 · 2025-12-15T09:43:07.000-07:00
Closes gh-18269 Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
diff --git a/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoder.java b/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtEncoder.java
@@ -136,7 +136,7 @@ private NimbusJwtEncoder(JWK jwk) {
 			algorithm = MacAlgorithm.from(jwk.getAlgorithm().getName());
 		}
 		Assert.notNull(algorithm, "Failed to derive supported algorithm from " + jwk.getAlgorithm());
-		JwsHeader.Builder builder = JwsHeader.with(algorithm).type(jwk.getKeyType().getValue()).keyId(jwk.getKeyID());
+		JwsHeader.Builder builder = JwsHeader.with(algorithm).type("JWT").keyId(jwk.getKeyID());
 		URI x509Url = jwk.getX509CertURL();
 		if (x509Url != null) {
 			builder.x509Url(jwk.getX509CertURL().toASCIIString());

Original file line number	Diff line number	Diff line change
`@@ -136,7 +136,7 @@ private NimbusJwtEncoder(JWK jwk) {`
`136`	`136`	`algorithm = MacAlgorithm.from(jwk.getAlgorithm().getName());`
`137`	`137`	`}`
`138`	`138`	`Assert.notNull(algorithm, "Failed to derive supported algorithm from " + jwk.getAlgorithm());`
`139`		`- JwsHeader.Builder builder = JwsHeader.with(algorithm).type(jwk.getKeyType().getValue()).keyId(jwk.getKeyID());`
	`139`	`+ JwsHeader.Builder builder = JwsHeader.with(algorithm).type("JWT").keyId(jwk.getKeyID());`
`140`	`140`	`URI x509Url = jwk.getX509CertURL();`
`141`	`141`	`if (x509Url != null) {`
`142`	`142`	`builder.x509Url(jwk.getX509CertURL().toASCIIString());`