restrict header fields

ssi-ucan/src/error.rs

@@ -10,6 +10,8 @@ pub enum Error {
     VerificationMethodMismatch,
     #[error("Missing UCAN field, expected: '{0}'")]
     MissingUCANHeaderField(&'static str),
+    #[error("Header contains invalid fields")]
+    InvalidHeaderEntries(ssi_jws::Header),
     #[error("Invalid DID URL")]
     DIDURL,
     #[error(transparent)]

ssi-ucan/src/lib.rs

@@ -133,10 +133,27 @@ impl<F, A> Ucan<F, A> {
             return Err(Error::MissingUCANHeaderField("type: JWT"));
         }
 
+        // header can only contain 'typ' and 'alg' fields
+        if parts.header
+            != (Header {
+                algorithm: parts.header.algorithm,
+                type_: Some("JWT".to_string()),
+                ..Default::default()
+            })
+        {
+            return Err(Error::InvalidHeaderEntries(parts.header));
+        };
+
+        // aud must be a DID
         if !payload.audience.starts_with("did:") {
             return Err(Error::DIDURL);
         }
 
+        // iss must be a DID
+        if !payload.issuer.starts_with("did:") {
+            return Err(Error::DIDURL);
+        }
+
         Ok(Self {
             header: parts.header,
             payload,