-
Type:
Task
-
Resolution: Unresolved
-
Priority:
Major - P3
-
None
-
Affects Version/s: None
-
Component/s: None
-
Server Security
-
Server Security 2026-08-28, Server Security 2026-09-11
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Tokens presented to MongoDB server during MONGODB-OIDC authentication may optionally include a typ claim in the header. If typ is provided, MongoDB server enforces that it must be set to "jwt" since that is the only type of token that the server recognizes.
Per RFC 9068, some IdPs issue JWT-formatted access tokens with typ set to at+jwt. Given that these tokens are effectively identical to the JWTs that the server is already able to accept, we should accept at+jwt as well as jwt if they're provided.