From 755bb73097ce0b881eea7a4249117438707ddd19 Mon Sep 17 00:00:00 2001
From: Timm Preetz <timm@preetz.us>
Date: Mon, 8 Sep 2025 10:08:37 +0200
Subject: [PATCH] fix: Require `header` to be a `Map` when decoding JWT Even
 though the header's contents are not checked.

---
 lib/src/jwt.dart      |  5 +++--
 test/header_test.dart | 13 +++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/lib/src/jwt.dart b/lib/src/jwt.dart
index b8b937e..7fe1342 100644
--- a/lib/src/jwt.dart
+++ b/lib/src/jwt.dart
@@ -197,7 +197,8 @@ class JWT {
   static JWT decode(String token) {
     try {
       final parts = token.split('.');
-      var header = jsonBase64.decode(base64Padded(parts[0]));
+      var header =
+          jsonBase64.decode(base64Padded(parts[0])) as Map<String, dynamic>;
 
       dynamic payload;
 
@@ -214,7 +215,7 @@ class JWT {
 
       return JWT(
         payload,
-        header: header is! Map<String, dynamic> ? null : header,
+        header: header,
         audience: audiance,
         issuer: issuer,
         subject: subject,
diff --git a/test/header_test.dart b/test/header_test.dart
index b9d40f4..2e8d8a2 100644
--- a/test/header_test.dart
+++ b/test/header_test.dart
@@ -147,5 +147,18 @@ void main() {
         });
       });
     });
+
+    group('invalid header', () {
+      test('invalid (non map) header should fail to decode', () {
+        final token =
+            'W10' + // base64 for `[]`, which can JSON decode but is not valid
+                '.eyJmb28iOiJiYXIifQ' +
+                '.'; // signature is not checked here
+
+        final jwt = JWT.tryDecode(token);
+
+        expect(jwt, isNull);
+      });
+    });
   });
 }