encoding/json is weird
Let's consider the following snippet
package main
import (
"encoding/json"
"fmt"
"log"
)
type Header struct {
Alg string `json:"alg"`
Typ string `json:"typ"`
}
func main() {
b := []byte(`{"typ":"JWS","alg":"HS256","ALG":"none"}`)
var h Header
if err := json.Unmarshal(b, &h); err != nil {
log.Fatal(err)
}
fmt.Printf("%+v", h)
}
The result is surprising : {Alg:none Typ:JWS}
This cause an security issue for token verification in JWT