The library unconditionally adds JWE header as additional authenticated data about jose-php

[nov]

Which library allows you to specify JWE AAD in JWE compact serialization format?
In compact serialization, all JWE header should be JWE Protected Header, thus all header should be integrity protected.

[jaimeperez]

Hi Nov, and thanks for the prompt response!

You are absolutely right, I was looking into the wrong specs (mainly JWA), and I've seen now that the JOSE header equals the JWE protected header in case of compact serialization, so in that case the header should indeed be included in the computation of the authentication tag. My problem then is that the library I'm using to generate JWE tokens is ignoring that part of the RFC, so the authentication tag does not include the header. I've already notified them of the problem 😃