Header policy

[sigmavirus24]

Working on a toy project that might turn into something open source eventually, I've been using jose to deal with JWS and JWK. One thing I'm looking for is a way to enforce a header is only sent as protected (or unprotected) and/or that no headers were sent unprotected. Right now, for every header I want to look up that isn't a standard header I'm doing something along the lines of

match header.additional("header") {
  Some(HeaderValue::Protected(serde_json::Value::String(v))) => Ok(v),
  Some(HeaderValue::Protected(_)) => Err(HeaderError::InvalidHeaderTypeFor("header")),
  Some(HeaderValue::Unprotected(_)) => Err(HeaderError::UnprotectedHeader("header")),
  None => Err(HeaderError::MissingHeader("header")),
}

With enough values this is cumbersome. The policies around JWKs is nice... if not entirely what I was looking for there, so I was wondering if a similar policy logic could be introduced for jose::header. I saw that jose::policy moved to jose::jwk::policy since 0.0.2.

[Erik1000]

Hi,
yes, it is planned to introduce separate policy traits for JoseHeader as well as eventually for JWS and JWE in order to support use cases like yours. Perhaps you could give an example what kind of methods a JoseHeaderPolicy should provide for you?

[sigmavirus24]

I have been trying to think of things that would be useful to more than just me. My understanding of the JOSE RFCs is not as deep and mostly through a couple of lenses of applications of the RFCs.

One thing I'm thinking is verifying headers are protected or unprotected. For my application, requiring no unprotected headers and only a handful of others allowed in addition to a set of standard protected headers. I'm not familiar enough to know if the trait can have a default implementation of what must be protected if present or otherwise (I think I remember some headers must be protected by spec but I'm not sure off the top of my head which ones).

I'd be up for contributing this too with the caveat that I'm still trying to get better at using Rust so I may make mistakes that would otherwise be frustrating.

I'd also be interested in helping with the JWS policy implementation