fix(jwt) fix typ handling

[cdimascio]

Summary

When using JOSE (Json Object Signature and Validation), Kong incorrectly returns:

{"message":"Bad token; invalid typ"}

After some investigation (see #4217), it appears that Kong explicitly rejects any typ not equal to JWT. This includes typ JOSE.

RFC 7519 section 5.1 states:

...This [typ] parameter is ignored by JWT implementations; any processing of this parameter is
performed by the JWT application....

Given the above statement, it appears that Kong should ignore the typ header. This PR does that.
Effectively, this change resolves the original invalid typ and is able to properly verify a JWT with typ JOSE.

Full changelog

• [Implement ...]
• [Add related tests]
• ...

Issues resolved

Fix #4217

[cdimascio]

RFC7519 section 5.1 include below for convenience:

5.1. "typ" (Type) Header Parameter

The "typ" (type) Header Parameter defined by [JWS] and [JWE] is used
by JWT applications to declare the media type [IANA.MediaTypes] of
this complete JWT. This is intended for use by the JWT application
when values that are not JWTs could also be present in an application
data structure that can contain a JWT object; the application can use
this value to disambiguate among the different kinds of objects that
might be present. It will typically not be used by applications when
it is already known that the object is a JWT. This parameter is
ignored by JWT implementations; any processing of this parameter is
performed by the JWT application. If present, it is RECOMMENDED that
its value be "JWT" to indicate that this object is a JWT. While
media type names are not case sensitive, it is RECOMMENDED that "JWT"
always be spelled using uppercase characters for compatibility with
legacy implementations. Use of this Header Parameter is OPTIONAL.

Based on the above, perhaps, the correct behavior is to remove the check entirely. (updating the PR)

[cdimascio]

Hello All,
Is there anything missing from this PR that is required for the review? I'm glad to help however I can.
Thanks for all that you do!

[hishamhm]

The change looks coherent with the RFC indeed!

[hishamhm]

@cdimascio Merged, thank you!

[cdimascio]

Thanks @hishamhm!