When do you use an insecure JWS header?

Question

I do not understand why insecure JWS headers exist.

In some context: an insecure JWS header contains parameters that are not integrity protected and can only be used for every signature with a JSON sequence.

If they can be used as a top-level title, I can understand why someone might want to include a mutable parameter (which will not change the signature). However, it is not.

Can anyone think of a use case or find out why they are included in the specification?

Thank!

JWS Specification

Answer 1

Florent's answer leaves me unsatisfied.

JWT ... , keyID " ", "". , "". ID.

, JWT, , alg = HS256 keyid = XXXX1. JWT .

1

, JWT, . , , alg = None.

() . " "; (), , . JWT " ".

2

, alg = RS256 keyId = XXX1. :

• , ,

JWT.

3

, alg = HS256 keyId = ZZ3. JWT.

. , .

: JWT?

, JWS - , . alg () (Key ID). , . . : - , .

: JWS? , "", " "? JWS , . , - JSON, - JSON, . , , ?

JWS . , , . , . , . .

. , JSON. JWT, JWS. RFC 7515, JWS, , JSON. , . JSON. " ". JWS , ( JSON) .

, JSON , JWS " ". , , - "", : . .

, JSON . :

{
   "image" : "qw93u9839839...base64-encoded image data..."
}

JSON.

{
   "image" : "qw93u9839839...base64-encoded image data..."
   "author" : "Whatever"
}

.

, JSON, . JWS , JSON, .