Error when validating MS Entra access token JWT: "Unsupported {'nonce'} in header"

[bjmc]

I don't know if this a vendor-specific issue or not, but Microsoft includes a nonce field in the header of their JWT access tokens. Because joserfc strictly validates the keys in the header against its registry, this causes these tokens to fail validation.

How would you feel about accepting a nonce parameter in the header and exposing it to callers that wish to validate it?

[lepture]

You can set validator for nonce yourself.

https://jose.authlib.org/en/guide/jwt/#validate-claims