Make typ optional

CHANGELOG.rst

@@ -18,6 +18,7 @@ Fixed
 - Remove padding from JWK test data. `#628 <https://github.com/jpadilla/pyjwt/pull/628>`__
 - Make `kty` mandatory in JWK to be compliant with RFC7517. `#624 <https://github.com/jpadilla/pyjwt/pull/624>`__
 - Allow JWK without `alg` to be compliant with RFC7517. `#624 <https://github.com/jpadilla/pyjwt/pull/624>`__
+- Make `typ` optional in JWT to be compliant with RFC7519. `#644 <https://github.com/jpadilla/pyjwt/pull/644>`__
 - Allow to verify with private key on ECAlgorithm, as well as on Ed25519Algorithm. `#645 <https://github.com/jpadilla/pyjwt/pull/645>`__
 
 Added

docs/api.rst

@@ -3,7 +3,7 @@ API Reference
 
 .. module:: jwt
 
-.. function:: encode(payload, key, algorithm="HS256", headers=None, json_encoder=None)
+.. function:: encode(payload, key, algorithm="HS256", headers=None, json_encoder=None, typ="JWT")
 
     Encode the ``payload`` as JSON Web Token.
 
@@ -16,6 +16,7 @@ API Reference
     :param str algorithm: algorithm to sign the token with, e.g. ``"ES256"``
     :param dict headers: additional JWT header fields, e.g. ``dict(kid="my-key-id")``
     :param json.JSONEncoder json_encoder: custom JSON encoder for ``payload`` and ``headers``
+    :param str typ: media type of the payload, e.g. ``"secevent+jwt"``
     :rtype: str
     :returns: a JSON Web Token
 

jwt/api_jws.py

@@ -19,8 +19,6 @@
 
 
 class PyJWS:
-    header_typ = "JWT"
-
     def __init__(self, algorithms=None, options=None):
         self._algorithms = get_default_algorithms()
         self._valid_algs = (
@@ -80,6 +78,7 @@ def encode(
         algorithm: str = "HS256",
         headers: Optional[Dict] = None,
         json_encoder: Optional[Type[json.JSONEncoder]] = None,
+        typ: Optional[str] = "JWT",
     ) -> str:
         segments = []
 
@@ -90,7 +89,8 @@ def encode(
             pass
 
         # Header
-        header = {"typ": self.header_typ, "alg": algorithm}
+        header = {"typ": typ} if typ else {}
+        header["alg"] = algorithm
 
         if headers:
             self._validate_headers(headers)

jwt/api_jwt.py

@@ -41,6 +41,7 @@ def encode(
         algorithm: str = "HS256",
         headers: Optional[Dict] = None,
         json_encoder: Optional[Type[json.JSONEncoder]] = None,
+        typ: Optional[str] = "JWT",
     ) -> str:
         # Check that we get a mapping
         if not isinstance(payload, Mapping):
@@ -60,7 +61,7 @@ def encode(
             payload, separators=(",", ":"), cls=json_encoder
         ).encode("utf-8")
 
-        return api_jws.encode(json_payload, key, algorithm, headers, json_encoder)
+        return api_jws.encode(json_payload, key, algorithm, headers, json_encoder, typ)
 
     def decode_complete(
         self,

tests/test_api_jws.py

@@ -624,6 +624,68 @@ def test_encode_headers_parameter_adds_headers(self, jws, payload):
         assert "testheader" in header_obj
         assert header_obj["testheader"] == headers["testheader"]
 
+    def test_encode_with_typ(self, jws):
+        payload = """
+        {
+          "iss": "https://scim.example.com",
+          "iat": 1458496404,
+          "jti": "4d3559ec67504aaba65d40b0363faad8",
+          "aud": [
+            "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",
+            "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7"
+          ],
+          "events": {
+            "urn:ietf:params:scim:event:create": {
+              "ref":
+                  "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",
+              "attributes": ["id", "name", "userName", "password", "emails"]
+            }
+          }
+        }
+        """
+        token = jws.encode(payload.encode("utf-8"), "secret", typ="secevent+jwt")
+
+        header = token[0 : token.index(".")].encode()
+        header = base64url_decode(header)
+        header_obj = json.loads(header)
+
+        assert "typ" in header_obj
+        assert header_obj["typ"] == "secevent+jwt"
+
+    def test_encode_with_typ_empty_string(self, jws, payload):
+        token = jws.encode(payload, "secret", typ="")
+
+        header = token[0 : token.index(".")].encode()
+        header = base64url_decode(header)
+        header_obj = json.loads(header)
+
+        assert "typ" not in header_obj
+
+    def test_encode_with_typ_and_headers_include_typ(self, jws, payload):
+        headers = {"typ": "a"}
+        token = jws.encode(payload, "secret", typ="b", headers=headers)
+
+        header = token[0 : token.index(".")].encode()
+        header = base64url_decode(header)
+        header_obj = json.loads(header)
+
+        assert "typ" in header_obj
+        # typ in headers overwrites typ parameter.
+        assert header_obj["typ"] == "a"
+
+    def test_encode_with_typ_without_keywords(self, jws, payload):
+        headers = {"foo": "bar"}
+        token = jws.encode(payload, "secret", "HS256", headers, None, "baz")
+
+        header = token[0 : token.index(".")].encode()
+        header = base64url_decode(header)
+        header_obj = json.loads(header)
+
+        assert "foo" in header_obj
+        assert header_obj["foo"] == "bar"
+        assert "typ" in header_obj
+        assert header_obj["typ"] == "baz"
+
     def test_encode_fails_on_invalid_kid_types(self, jws, payload):
         with pytest.raises(InvalidTokenError) as exc:
             jws.encode(payload, "secret", headers={"kid": 123})

tests/test_api_jwt.py

@@ -16,6 +16,7 @@
     InvalidIssuerError,
     MissingRequiredClaimError,
 )
+from jwt.utils import base64url_decode
 
 from .utils import crypto_required, key_path, utc_timestamp
 
@@ -167,6 +168,30 @@ def test_encode_bad_type(self, jwt):
                 lambda: jwt.encode(t, "secret", algorithms=["HS256"]),
             )
 
+    def test_encode_with_typ(self, jwt):
+        payload = {
+            "iss": "https://scim.example.com",
+            "iat": 1458496404,
+            "jti": "4d3559ec67504aaba65d40b0363faad8",
+            "aud": [
+                "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",
+                "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7",
+            ],
+            "events": {
+                "urn:ietf:params:scim:event:create": {
+                    "ref": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",
+                    "attributes": ["id", "name", "userName", "password", "emails"],
+                }
+            },
+        }
+        token = jwt.encode(payload, "secret", algorithm="HS256", typ="secevent+jwt")
+        header = token[0 : token.index(".")].encode()
+        header = base64url_decode(header)
+        header_obj = json.loads(header)
+
+        assert "typ" in header_obj
+        assert header_obj["typ"] == "secevent+jwt"
+
     def test_decode_raises_exception_if_exp_is_not_int(self, jwt):
         # >>> jwt.encode({'exp': 'not-an-int'}, 'secret')
         example_jwt = (