CTY header is not set for JWE

I’m using the following code to issue my JWEs:

var signCreds = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:SigningKey"])), SecurityAlgorithms.HmacSha256);
var encryptionCreds = new EncryptingCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:Encryptionkey"])), SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);

var handler = new JwtSecurityTokenHandler();


var jwtSecurityToken = handler.CreateJwtSecurityToken(
  Configuration["Jwt:Issuer"],
  Configuration["Jwt:Audience"],
  new ClaimsIdentity(claims),
  DateTime.UtcNow,
  expiresIn,
  DateTime.UtcNow,
  signCreds,
  encryptionCreds);

But it doesn’t specify “cty” header of the token - just only alg, enc and typ. If I understand correctly, the header must be set for encrypted JWT so I have an issue while parsing the token in golang because of the headers absence.

I also tried the following ways to issue JWE:

var signCreds = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:SigningKey"])), SecurityAlgorithms.HmacSha256);
var encryptionCreds = new EncryptingCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:Encryptionkey"])), SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);

var handler = new JwtSecurityTokenHandler();

var tokenDescriptor1 = new SecurityTokenDescriptor
  {
     Audience = "you",
     Issuer = "me",
     Subject = new ClaimsIdentity(claims),
     EncryptingCredentials = encryptionCreds
};

var tokenDescriptor2 = new SecurityTokenDescriptor
  {
     Audience = "you",
     Issuer = "me",
     Subject = new ClaimsIdentity(claims),
     EncryptingCredentials = encryptionCreds,
     SigningCredentials = signCreds
};

var tokenDescriptor3 = new SecurityTokenDescriptor
  {
     Audience = "you",
     Issuer = "me",
     Subject = new ClaimsIdentity(claims),
     EncryptingCredentials = encryptionCreds,
     SigningCredentials = signCreds,
     AdditionalHeaderClaims = new Dictionary<string, object> { { "cty", "JWT" } }
   };

var enc = handler.CreateEncodedJwt(tokenDescriptor1);
var encSigned = handler.CreateEncodedJwt(tokenDescriptor2);
var encSignedWithCty = handler.CreateEncodedJwt(tokenDescriptor3);

But have the same result:

[DShauchuk-IBA]

Thank you for the quick answer.

I’m using go-jose library for parsing JWT.

[CumpsD]

Perhaps a silly question, but does this code mean a cty header will always be present when creating a JWT?

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/src/System.IdentityModel.Tokens.Jwt/JwtHeader.cs#L389-L404

        internal void AddAdditionalClaims(IDictionary<string, object> additionalHeaderClaims)
        {
            if (additionalHeaderClaims?.Count > 0 && additionalHeaderClaims.Keys.Intersect(DefaultHeaderParameters, StringComparer.OrdinalIgnoreCase).Any())
                throw LogHelper.LogExceptionMessage(new SecurityTokenException(LogHelper.FormatInvariant(LogMessages.IDX12742, nameof(additionalHeaderClaims), string.Join(", ", DefaultHeaderParameters))));

            if (additionalHeaderClaims != null)
            {
                if (!additionalHeaderClaims.TryGetValue(JwtHeaderParameterNames.Cty, out _))
                    Cty = JwtConstants.HeaderType;

                foreach (string claim in additionalHeaderClaims.Keys)
                    this[claim] = additionalHeaderClaims[claim];
            }
            else
                Cty = JwtConstants.HeaderType;
        }

since that is being called in the ctor