home icon Kha Research Blog
GithubTwitter

encoding/json is weird

Let's consider the following snippet

package main

import (
	"encoding/json"
	"fmt"
	"log"
)

type Header struct {
	Alg string `json:"alg"`
	Typ string `json:"typ"`
}

func main() {
	b := []byte(`{"typ":"JWS","alg":"HS256","ALG":"none"}`)
	var h Header
	if err := json.Unmarshal(b, &h); err != nil {
		log.Fatal(err)
	}
	fmt.Printf("%+v", h)
}

The result is surprising : {Alg:none Typ:JWS}

This cause an security issue for token verification in JWT