@sd-jwt/core 0.19.1-next.12 → 0.19.1-next.13

package/dist/index.d.mts

@@ -548,11 +548,12 @@ declare class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
         header?: object;
     }): Promise<SDJWTCompact>;
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-     * @param disclosureFrame
+     * Validates if the payload contains any reserved claim names. If so it will throw an error.
+     * @param payload
      * @returns
      */
-    protected validateReservedFields<T extends ExtendedPayload>(_disclosureFrame: DisclosureFrame<T>): void;
+    protected validateReservedFields<T extends ExtendedPayload>(payload: T): void;
+    protected validateDisclosureFrame<T extends ExtendedPayload>(_disclosureFrame?: DisclosureFrame<T>): void;
     present<T extends Record<string, unknown>>(encodedSDJwt: string, presentationFrame?: PresentationFrame<T>, options?: {
         kb?: KBOptions;
     }): Promise<SDJWTCompact>;
@@ -621,21 +622,22 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
         }>;
     }): Promise<GeneralJSON>;
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-     * @param disclosureFrame
+     * Validates if the payload contains any reserved claim names. If so it will throw an error.
+     * @param payload
      * @returns
      */
-    protected validateReservedFields<T extends ExtendedPayload>(_disclosureFrame: DisclosureFrame<T>): void;
+    protected validateReservedFields<T extends ExtendedPayload>(payload: T): void;
+    protected validateDisclosureFrame<T extends ExtendedPayload>(_disclosureFrame?: DisclosureFrame<T>): void;
     present<T extends Record<string, unknown>>(generalJSON: GeneralJSON, presentationFrame?: PresentationFrame<T>, options?: {
         kb?: KBOptions;
     }): Promise<GeneralJSON>;
     verify(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
         kb?: undefined;
     } | {
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
         kb: {
             payload: kbPayload;
             header: kbHeader;
@@ -644,7 +646,7 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     private calculateSDHash;
     validate(generalJSON: GeneralJSON): Promise<{
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
     }>;
     config(newConfig: SDJWTConfig): void;
     encode(sdJwt: GeneralJSON, index: number): SDJWTCompact;

package/dist/index.d.ts

@@ -548,11 +548,12 @@ declare class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
         header?: object;
     }): Promise<SDJWTCompact>;
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-     * @param disclosureFrame
+     * Validates if the payload contains any reserved claim names. If so it will throw an error.
+     * @param payload
      * @returns
      */
-    protected validateReservedFields<T extends ExtendedPayload>(_disclosureFrame: DisclosureFrame<T>): void;
+    protected validateReservedFields<T extends ExtendedPayload>(payload: T): void;
+    protected validateDisclosureFrame<T extends ExtendedPayload>(_disclosureFrame?: DisclosureFrame<T>): void;
     present<T extends Record<string, unknown>>(encodedSDJwt: string, presentationFrame?: PresentationFrame<T>, options?: {
         kb?: KBOptions;
     }): Promise<SDJWTCompact>;
@@ -621,21 +622,22 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
         }>;
     }): Promise<GeneralJSON>;
     /**
-     * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-     * @param disclosureFrame
+     * Validates if the payload contains any reserved claim names. If so it will throw an error.
+     * @param payload
      * @returns
      */
-    protected validateReservedFields<T extends ExtendedPayload>(_disclosureFrame: DisclosureFrame<T>): void;
+    protected validateReservedFields<T extends ExtendedPayload>(payload: T): void;
+    protected validateDisclosureFrame<T extends ExtendedPayload>(_disclosureFrame?: DisclosureFrame<T>): void;
     present<T extends Record<string, unknown>>(generalJSON: GeneralJSON, presentationFrame?: PresentationFrame<T>, options?: {
         kb?: KBOptions;
     }): Promise<GeneralJSON>;
     verify(generalJSON: GeneralJSON, options?: VerifierOptions): Promise<{
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
         kb?: undefined;
     } | {
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
         kb: {
             payload: kbPayload;
             header: kbHeader;
@@ -644,7 +646,7 @@ declare class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     private calculateSDHash;
     validate(generalJSON: GeneralJSON): Promise<{
         payload: ExtendedPayload;
-        headers: any[];
+        headers: unknown[];
     }>;
     config(newConfig: SDJWTConfig): void;
     encode(sdJwt: GeneralJSON, index: number): SDJWTCompact;

package/dist/index.js

@@ -161,6 +161,18 @@ function ensureError(value) {
   return new Error(String(value));
 }
 
+// src/utils/strict-json.ts
+var utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+var decodeBase64urlJsonStrict = (encoded, errorMessage) => {
+  try {
+    const bytes = (0, import_identity_common.base64UrlToUint8Array)(encoded);
+    const decoded = utf8Decoder.decode(bytes);
+    return JSON.parse(decoded);
+  } catch (e) {
+    throw new SDJWTException(errorMessage);
+  }
+};
+
 // src/utils/disclosure.ts
 var Disclosure = class _Disclosure {
   constructor(data, _meta) {
@@ -187,7 +199,10 @@ var Disclosure = class _Disclosure {
       const { hasher, alg } = hash;
       const digest = yield hasher(s, alg);
       const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
-      const item = JSON.parse((0, import_identity_common.base64urlDecode)(s));
+      const item = decodeBase64urlJsonStrict(
+        s,
+        "Invalid disclosure data"
+      );
       return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
     });
   }
@@ -195,7 +210,10 @@ var Disclosure = class _Disclosure {
     const { hasher, alg } = hash;
     const digest = hasher(s, alg);
     const digestStr = (0, import_identity_common.uint8ArrayToBase64Url)(digest);
-    const item = JSON.parse((0, import_identity_common.base64urlDecode)(s));
+    const item = decodeBase64urlJsonStrict(
+      s,
+      "Invalid disclosure data"
+    );
     return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
   }
   static fromArray(item, _meta) {
@@ -237,8 +255,8 @@ var decodeJwt = (jwt) => {
     throw new SDJWTException("Invalid JWT as input");
   }
   return {
-    header: JSON.parse((0, import_identity_common.base64urlDecode)(header)),
-    payload: JSON.parse((0, import_identity_common.base64urlDecode)(payload)),
+    header: decodeBase64urlJsonStrict(header, "Invalid JWT as input"),
+    payload: decodeBase64urlJsonStrict(payload, "Invalid JWT as input"),
     signature
   };
 };
@@ -431,6 +449,11 @@ var getSDAlgAndPayload = (SdJwtPayload) => {
   if (typeof _sd_alg !== "string") {
     return { _sd_alg: "sha-256", payload };
   }
+  if (!IANA_HASH_ALGORITHMS.includes(
+    _sd_alg
+  )) {
+    throw new SDJWTException(`Invalid _sd_alg: ${_sd_alg}`);
+  }
   return { _sd_alg, payload };
 };
 var unpack = (SdJwtPayload, disclosures, hasher) => __async(null, null, function* () {
@@ -1155,9 +1178,8 @@ var _SDJwtInstance = class _SDJwtInstance {
       if (!this.userConfig.signAlg) {
         throw new SDJWTException("sign alogrithm not specified");
       }
-      if (disclosureFrame) {
-        this.validateReservedFields(disclosureFrame);
-      }
+      this.validateReservedFields(payload);
+      this.validateDisclosureFrame(disclosureFrame);
       const hasher = this.userConfig.hasher;
       const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : _SDJwtInstance.DEFAULT_hashAlg;
       const { packedClaims, disclosures } = yield pack(
@@ -1185,11 +1207,30 @@ var _SDJwtInstance = class _SDJwtInstance {
     });
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  validateReservedFields(_disclosureFrame) {
+  validateReservedFields(payload) {
+    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
+    const visit = (node) => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+      for (const [key, value] of Object.entries(
+        node
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`
+          );
+        }
+        visit(value);
+      }
+    };
+    visit(payload);
+  }
+  validateDisclosureFrame(_disclosureFrame) {
     return;
   }
   present(encodedSDJwt, presentationFrame, options) {
@@ -1565,9 +1606,8 @@ var SDJwtGeneralJSONInstance = class {
       if (!this.userConfig.saltGenerator) {
         throw new SDJWTException("SaltGenerator not found");
       }
-      if (disclosureFrame) {
-        this.validateReservedFields(disclosureFrame);
-      }
+      this.validateReservedFields(payload);
+      this.validateDisclosureFrame(disclosureFrame);
       const hasher = this.userConfig.hasher;
       const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : SDJwtInstance.DEFAULT_hashAlg;
       const { packedClaims, disclosures } = yield pack(
@@ -1576,10 +1616,12 @@ var SDJwtGeneralJSONInstance = class {
         { hasher, alg: hashAlg },
         this.userConfig.saltGenerator
       );
-      const encodedDisclosures = disclosures.map((d) => d.encode());
       const encodedSDJwtPayload = this.encodeObj(__spreadProps(__spreadValues({}, packedClaims), {
         _sd_alg: disclosureFrame ? hashAlg : void 0
       }));
+      const encodedDisclosures = disclosures.map(
+        (disclosure) => disclosure.encode()
+      );
       const signatures = yield Promise.all(
         options.sigs.map((s) => __async(this, null, function* () {
           const { signer, alg, kid, header } = s;
@@ -1590,7 +1632,6 @@ var SDJwtGeneralJSONInstance = class {
           );
           return {
             protected: encodedProtectedHeader,
-            kid,
             signature
           };
         }))
@@ -1604,11 +1645,30 @@ var SDJwtGeneralJSONInstance = class {
     });
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  validateReservedFields(_disclosureFrame) {
+  validateReservedFields(payload) {
+    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
+    const visit = (node) => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+      for (const [key, value] of Object.entries(
+        node
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`
+          );
+        }
+        visit(value);
+      }
+    };
+    visit(payload);
+  }
+  validateDisclosureFrame(_disclosureFrame) {
     return;
   }
   present(generalJSON, presentationFrame, options) {
@@ -1741,7 +1801,7 @@ var SDJwtGeneralJSONInstance = class {
             `${encodedHeader}.${payload}`,
             signature
           );
-          const header = JSON.parse((0, import_identity_common.base64urlDecode)(encodedHeader));
+          const header = decodeBase64urlJsonStrict(encodedHeader, "Invalid JWT");
           return { verified: verified2, header };
         }))
       );

package/dist/index.mjs

@@ -102,6 +102,18 @@ function ensureError(value) {
   return new Error(String(value));
 }
 
+// src/utils/strict-json.ts
+var utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+var decodeBase64urlJsonStrict = (encoded, errorMessage) => {
+  try {
+    const bytes = base64UrlToUint8Array(encoded);
+    const decoded = utf8Decoder.decode(bytes);
+    return JSON.parse(decoded);
+  } catch (e) {
+    throw new SDJWTException(errorMessage);
+  }
+};
+
 // src/utils/disclosure.ts
 var Disclosure = class _Disclosure {
   constructor(data, _meta) {
@@ -128,7 +140,10 @@ var Disclosure = class _Disclosure {
       const { hasher, alg } = hash;
       const digest = yield hasher(s, alg);
       const digestStr = uint8ArrayToBase64Url(digest);
-      const item = JSON.parse(base64urlDecode(s));
+      const item = decodeBase64urlJsonStrict(
+        s,
+        "Invalid disclosure data"
+      );
       return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
     });
   }
@@ -136,7 +151,10 @@ var Disclosure = class _Disclosure {
     const { hasher, alg } = hash;
     const digest = hasher(s, alg);
     const digestStr = uint8ArrayToBase64Url(digest);
-    const item = JSON.parse(base64urlDecode(s));
+    const item = decodeBase64urlJsonStrict(
+      s,
+      "Invalid disclosure data"
+    );
     return _Disclosure.fromArray(item, { digest: digestStr, encoded: s });
   }
   static fromArray(item, _meta) {
@@ -178,8 +196,8 @@ var decodeJwt = (jwt) => {
     throw new SDJWTException("Invalid JWT as input");
   }
   return {
-    header: JSON.parse(base64urlDecode(header)),
-    payload: JSON.parse(base64urlDecode(payload)),
+    header: decodeBase64urlJsonStrict(header, "Invalid JWT as input"),
+    payload: decodeBase64urlJsonStrict(payload, "Invalid JWT as input"),
     signature
   };
 };
@@ -372,6 +390,11 @@ var getSDAlgAndPayload = (SdJwtPayload) => {
   if (typeof _sd_alg !== "string") {
     return { _sd_alg: "sha-256", payload };
   }
+  if (!IANA_HASH_ALGORITHMS.includes(
+    _sd_alg
+  )) {
+    throw new SDJWTException(`Invalid _sd_alg: ${_sd_alg}`);
+  }
   return { _sd_alg, payload };
 };
 var unpack = (SdJwtPayload, disclosures, hasher) => __async(null, null, function* () {
@@ -1096,9 +1119,8 @@ var _SDJwtInstance = class _SDJwtInstance {
       if (!this.userConfig.signAlg) {
         throw new SDJWTException("sign alogrithm not specified");
       }
-      if (disclosureFrame) {
-        this.validateReservedFields(disclosureFrame);
-      }
+      this.validateReservedFields(payload);
+      this.validateDisclosureFrame(disclosureFrame);
       const hasher = this.userConfig.hasher;
       const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : _SDJwtInstance.DEFAULT_hashAlg;
       const { packedClaims, disclosures } = yield pack(
@@ -1126,11 +1148,30 @@ var _SDJwtInstance = class _SDJwtInstance {
     });
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  validateReservedFields(_disclosureFrame) {
+  validateReservedFields(payload) {
+    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
+    const visit = (node) => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+      for (const [key, value] of Object.entries(
+        node
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`
+          );
+        }
+        visit(value);
+      }
+    };
+    visit(payload);
+  }
+  validateDisclosureFrame(_disclosureFrame) {
     return;
   }
   present(encodedSDJwt, presentationFrame, options) {
@@ -1506,9 +1547,8 @@ var SDJwtGeneralJSONInstance = class {
       if (!this.userConfig.saltGenerator) {
         throw new SDJWTException("SaltGenerator not found");
       }
-      if (disclosureFrame) {
-        this.validateReservedFields(disclosureFrame);
-      }
+      this.validateReservedFields(payload);
+      this.validateDisclosureFrame(disclosureFrame);
       const hasher = this.userConfig.hasher;
       const hashAlg = (_a = this.userConfig.hashAlg) != null ? _a : SDJwtInstance.DEFAULT_hashAlg;
       const { packedClaims, disclosures } = yield pack(
@@ -1517,10 +1557,12 @@ var SDJwtGeneralJSONInstance = class {
         { hasher, alg: hashAlg },
         this.userConfig.saltGenerator
       );
-      const encodedDisclosures = disclosures.map((d) => d.encode());
       const encodedSDJwtPayload = this.encodeObj(__spreadProps(__spreadValues({}, packedClaims), {
         _sd_alg: disclosureFrame ? hashAlg : void 0
       }));
+      const encodedDisclosures = disclosures.map(
+        (disclosure) => disclosure.encode()
+      );
       const signatures = yield Promise.all(
         options.sigs.map((s) => __async(this, null, function* () {
           const { signer, alg, kid, header } = s;
@@ -1531,7 +1573,6 @@ var SDJwtGeneralJSONInstance = class {
           );
           return {
             protected: encodedProtectedHeader,
-            kid,
             signature
           };
         }))
@@ -1545,11 +1586,30 @@ var SDJwtGeneralJSONInstance = class {
     });
   }
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  validateReservedFields(_disclosureFrame) {
+  validateReservedFields(payload) {
+    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
+    const visit = (node) => {
+      if (!node || typeof node !== "object") {
+        return;
+      }
+      for (const [key, value] of Object.entries(
+        node
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`
+          );
+        }
+        visit(value);
+      }
+    };
+    visit(payload);
+  }
+  validateDisclosureFrame(_disclosureFrame) {
     return;
   }
   present(generalJSON, presentationFrame, options) {
@@ -1682,7 +1742,7 @@ var SDJwtGeneralJSONInstance = class {
             `${encodedHeader}.${payload}`,
             signature
           );
-          const header = JSON.parse(base64urlDecode(encodedHeader));
+          const header = decodeBase64urlJsonStrict(encodedHeader, "Invalid JWT");
           return { verified: verified2, header };
         }))
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/core",
-  "version": "0.19.1-next.12+c9d73e4",
+  "version": "0.19.1-next.13+3d8a72a",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -58,5 +58,5 @@
       "esm"
     ]
   },
-  "gitHead": "c9d73e4db2a925e5096988fffe7eded62db1b6a7"
+  "gitHead": "3d8a72a0a279d67439db038c9c2b52621568b866"
 }

package/src/decode/decode.ts

@@ -1,12 +1,15 @@
-import type { HasherAndAlgSync, HasherSync } from '../types';
 import {
   type Hasher,
   type HasherAndAlg,
+  type HasherAndAlgSync,
+  type HasherSync,
+  IANA_HASH_ALGORITHMS,
   SD_DIGEST,
   SD_LIST_KEY,
   SD_SEPARATOR,
 } from '../types';
-import { base64urlDecode, Disclosure, SDJWTException } from '../utils';
+import { Disclosure, SDJWTException } from '../utils';
+import { decodeBase64urlJsonStrict } from '../utils/strict-json';
 
 export const decodeJwt = <
   H extends Record<string, unknown>,
@@ -20,8 +23,8 @@ export const decodeJwt = <
   }
 
   return {
-    header: JSON.parse(base64urlDecode(header)),
-    payload: JSON.parse(base64urlDecode(payload)),
+    header: decodeBase64urlJsonStrict(header, 'Invalid JWT as input'),
+    payload: decodeBase64urlJsonStrict(payload, 'Invalid JWT as input'),
     signature: signature,
   };
 };
@@ -319,6 +322,13 @@ export const getSDAlgAndPayload = (SdJwtPayload: Record<string, unknown>) => {
     // This is for compatibility
     return { _sd_alg: 'sha-256', payload };
   }
+  if (
+    !IANA_HASH_ALGORITHMS.includes(
+      _sd_alg as (typeof IANA_HASH_ALGORITHMS)[number],
+    )
+  ) {
+    throw new SDJWTException(`Invalid _sd_alg: ${_sd_alg}`);
+  }
   return { _sd_alg, payload };
 };
 

package/src/index.ts

@@ -12,6 +12,8 @@ import {
   type KBOptions,
   type PresentationFrame,
   type SafeVerifyResult,
+  SD_DECOY,
+  SD_DIGEST,
   type SDJWTCompact,
   type SDJWTConfig,
   type Signer,
@@ -19,12 +21,12 @@ import {
   type VerificationErrorCode,
 } from './types';
 import {
-  base64urlDecode,
   base64urlEncode,
   ensureError,
   SDJWTException,
   uint8ArrayToBase64Url,
 } from './utils';
+import { decodeBase64urlJsonStrict } from './utils/strict-json';
 
 export * from './decode';
 export * from './decoy';
@@ -120,9 +122,8 @@ export class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
       throw new SDJWTException('sign alogrithm not specified');
     }
 
-    if (disclosureFrame) {
-      this.validateReservedFields<Payload>(disclosureFrame);
-    }
+    this.validateReservedFields<Payload>(payload);
+    this.validateDisclosureFrame<Payload>(disclosureFrame);
 
     const hasher = this.userConfig.hasher;
     const hashAlg = this.userConfig.hashAlg ?? SDJwtInstance.DEFAULT_hashAlg;
@@ -157,12 +158,35 @@ export class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
   }
 
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  protected validateReservedFields<T extends ExtendedPayload>(
-    _disclosureFrame: DisclosureFrame<T>,
+  protected validateReservedFields<T extends ExtendedPayload>(payload: T) {
+    const reservedFields = new Set([SD_DIGEST, '_sd_alg', SD_DECOY]);
+
+    const visit = (node: unknown) => {
+      if (!node || typeof node !== 'object') {
+        return;
+      }
+
+      for (const [key, value] of Object.entries(
+        node as Record<string, unknown>,
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`,
+          );
+        }
+        visit(value);
+      }
+    };
+
+    visit(payload);
+  }
+
+  protected validateDisclosureFrame<T extends ExtendedPayload>(
+    _disclosureFrame?: DisclosureFrame<T>,
   ) {
     return;
   }
@@ -629,9 +653,8 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
       throw new SDJWTException('SaltGenerator not found');
     }
 
-    if (disclosureFrame) {
-      this.validateReservedFields<Payload>(disclosureFrame);
-    }
+    this.validateReservedFields<Payload>(payload);
+    this.validateDisclosureFrame<Payload>(disclosureFrame);
 
     const hasher = this.userConfig.hasher;
     const hashAlg = this.userConfig.hashAlg ?? SDJwtInstance.DEFAULT_hashAlg;
@@ -643,12 +666,15 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
       this.userConfig.saltGenerator,
     );
 
-    const encodedDisclosures = disclosures.map((d) => d.encode());
     const encodedSDJwtPayload = this.encodeObj({
       ...packedClaims,
       _sd_alg: disclosureFrame ? hashAlg : undefined,
     });
 
+    const encodedDisclosures = disclosures.map((disclosure) =>
+      disclosure.encode(),
+    );
+
     const signatures = await Promise.all(
       options.sigs.map(async (s) => {
         const { signer, alg, kid, header } = s;
@@ -660,7 +686,6 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
 
         return {
           protected: encodedProtectedHeader,
-          kid,
           signature,
         };
       }),
@@ -676,12 +701,35 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
   }
 
   /**
-   * Validates if the disclosureFrame contains any reserved fields. If so it will throw an error.
-   * @param disclosureFrame
+   * Validates if the payload contains any reserved claim names. If so it will throw an error.
+   * @param payload
    * @returns
    */
-  protected validateReservedFields<T extends ExtendedPayload>(
-    _disclosureFrame: DisclosureFrame<T>,
+  protected validateReservedFields<T extends ExtendedPayload>(payload: T) {
+    const reservedFields = new Set([SD_DIGEST, '_sd_alg', SD_DECOY]);
+
+    const visit = (node: unknown) => {
+      if (!node || typeof node !== 'object') {
+        return;
+      }
+
+      for (const [key, value] of Object.entries(
+        node as Record<string, unknown>,
+      )) {
+        if (reservedFields.has(key)) {
+          throw new SDJWTException(
+            `Reserved field name "${key}" is not allowed`,
+          );
+        }
+        visit(value);
+      }
+    };
+
+    visit(payload);
+  }
+
+  protected validateDisclosureFrame<T extends ExtendedPayload>(
+    _disclosureFrame?: DisclosureFrame<T>,
   ) {
     return;
   }
@@ -836,7 +884,7 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
           `${encodedHeader}.${payload}`,
           signature,
         );
-        const header = JSON.parse(base64urlDecode(encodedHeader));
+        const header = decodeBase64urlJsonStrict(encodedHeader, 'Invalid JWT');
         return { verified, header };
       }),
     );

package/src/test/index.spec.ts

@@ -100,6 +100,32 @@ describe('index', () => {
     expect(credential).toBeDefined();
   });
 
+  test('issue rejects reserved disclosure frame keys', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    await expect(
+      sdjwt.issue(
+        {
+          foo: 'bar',
+          _sd: 'reserved',
+          iss: 'Issuer',
+          iat: Math.floor(Date.now() / 1000),
+          vct: '',
+        },
+        {
+          _sd: ['foo'],
+        },
+      ),
+    ).rejects.toThrow('Reserved field name "_sd" is not allowed');
+  });
+
   test('verify failed', async () => {
     const { signer } = createSignerVerifier();
     const { publicKey } = Crypto.generateKeyPairSync('ed25519');
@@ -424,6 +450,38 @@ describe('index', () => {
     }
   });
 
+  test('decode rejects invalid _sd_alg values', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const credential = await sdjwt.issue(
+      {
+        foo: 'bar',
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000),
+        vct: '',
+      },
+      {
+        _sd: ['foo'],
+      },
+    );
+
+    const parts = credential.split('.');
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    payload._sd_alg = 'SHA-256';
+    parts[1] = Buffer.from(JSON.stringify(payload)).toString('base64url');
+
+    await expect(sdjwt.decode(parts.join('.'))).rejects.toThrow(
+      'Invalid _sd_alg: SHA-256',
+    );
+  });
+
   test('SaltGenerator not found', async () => {
     const sdjwt = new SDJwtInstance<SdJwtPayload>({
       hasher: digest,

package/src/utils/disclosure.ts

@@ -1,10 +1,7 @@
 import type { DisclosureData, HasherAndAlg, HasherAndAlgSync } from '../types';
-import {
-  base64urlDecode,
-  base64urlEncode,
-  uint8ArrayToBase64Url,
-} from './base64url';
+import { base64urlEncode, uint8ArrayToBase64Url } from './base64url';
 import { SDJWTException } from './error';
+import { decodeBase64urlJsonStrict } from './strict-json';
 
 export class Disclosure<T = unknown> {
   public salt: string;
@@ -42,7 +39,10 @@ export class Disclosure<T = unknown> {
     const { hasher, alg } = hash;
     const digest = await hasher(s, alg);
     const digestStr = uint8ArrayToBase64Url(digest);
-    const item = JSON.parse(base64urlDecode(s)) as DisclosureData<T>;
+    const item = decodeBase64urlJsonStrict<DisclosureData<T>>(
+      s,
+      'Invalid disclosure data',
+    );
     return Disclosure.fromArray<T>(item, { digest: digestStr, encoded: s });
   }
 
@@ -50,7 +50,10 @@ export class Disclosure<T = unknown> {
     const { hasher, alg } = hash;
     const digest = hasher(s, alg);
     const digestStr = uint8ArrayToBase64Url(digest);
-    const item = JSON.parse(base64urlDecode(s)) as DisclosureData<T>;
+    const item = decodeBase64urlJsonStrict<DisclosureData<T>>(
+      s,
+      'Invalid disclosure data',
+    );
     return Disclosure.fromArray<T>(item, { digest: digestStr, encoded: s });
   }
 

package/src/utils/strict-json.ts

@@ -0,0 +1,17 @@
+import { base64UrlToUint8Array } from './base64url';
+import { SDJWTException } from './error';
+
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
+
+export const decodeBase64urlJsonStrict = <T>(
+  encoded: string,
+  errorMessage: string,
+): T => {
+  try {
+    const bytes = base64UrlToUint8Array(encoded);
+    const decoded = utf8Decoder.decode(bytes);
+    return JSON.parse(decoded) as T;
+  } catch {
+    throw new SDJWTException(errorMessage);
+  }
+};

package/test/app-e2e.spec.ts

@@ -135,6 +135,37 @@ describe('App', () => {
     expect(verified).toBeDefined();
   });
 
+  test('rejects tampered disclosure bytes', async () => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      hashAlg: 'sha-256',
+      saltGenerator: generateSalt,
+    });
+
+    const claims = {
+      firstname: 'John',
+      lastname: 'Doe',
+    };
+    const disclosureFrame: DisclosureFrame<typeof claims> = {
+      _sd: ['firstname', 'lastname'],
+    };
+
+    const encodedSdjwt = await sdjwt.issue(claims, disclosureFrame);
+    const parts = encodedSdjwt.split('~');
+    const disclosureBytes = Buffer.from(parts[1], 'base64url');
+    disclosureBytes[2] = 0xf2;
+    parts[1] = Buffer.from(disclosureBytes).toString('base64url');
+    const tamperedSdjwt = parts.join('~');
+
+    await expect(sdjwt.verify(tamperedSdjwt)).rejects.toThrow(
+      'Invalid disclosure data',
+    );
+  });
+
   test('From JSON (complex)', async () => {
     await JSONtest('./complex.json');
   });