Protected Header is still readable for JWE about jwcrypto

[simo5]

The headers are used to provide the necessary information to the recipient to be able to decrypt the payload.
If the headers where themselves encrypted you wouldn't be able to decrypt the JWE.

Integrity protection has a specific meaning in cryptography and means simply: the data cannot be altered without the recipient knowing it has been altered.

Integrity protection does not imply encryption, it may be achieved, via MAC, Signatures, or other AEAD ciphers in the case of encryption.

Keep in mind that JWCrypto has an extensive suite of tests based on the standard's test vectors, which include JWEs test vectors.

If your system can deal with JWEs in the absence of a header that tells them any information, you can simply strip the protected header or leave it empty. The headers are never part of the payload, therefore are never encrypted.

Generally in JWE the integrity protection of the protected header is achieved by using the protected header as input in calculating the Authentication Tag.

[ds2286]

That makes a lot of sense. Thank you for clarifying that!