[Json] Go JSON parser ignores the case of member names

["Manger, James" <[e-mail]>]

I noticed that the default JSON parsing in the Go language basically ignores the case of member names. Do JSON experts see this case-insensitive parsing as a useful convenience for programmers (being lenient with what you receive), or as a bad insecure design choice?

Parsing {"typ":"JWS","alg":"HS256","ALG":"none"} with the following code, for instance, prints "none" (not "HS256") - contrary to what the programmer wanted.

type Header struct {
                Alg string `json:"alg"`
                Typ string `json:"typ"`
}

func main() {
                b := []byte(`{"typ":"JWS","alg":"HS256","ALG":"none"}`)
                var h Header
                err := json.Unmarshal(b, &h)
                fmt.Println(h)
}

This looks quite diabolical for security as it is trivial to create valid JSON values that will be interpreted differently by different implementations. I would expect most implementations (that are expecting an "alg" member) to see its "HS256" value and simply ignore the extra "ALG" member. Not Go, however. Note: An alternative implementation in Go could parse the JSON as a generic map, then looked for the "alg" member, which would give "HS256".

The relevant part of the Go documentation for the encoding/json<https://golang.org/pkg/encoding/json/#Unmarshal> package is:
  "To unmarshal JSON into a struct, Unmarshal matches incoming object keys to the keys used by Marshal (either the struct field name or its tag), preferring an exact match but also accepting a case-insensitive match."

--
James Manger