Let have a review of the definiations of JWS, JWE and JWT.
RFC7515: JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures.
RFC7516: JSON Web Encryption (JWE) represents encrypted content using JSON-based data structures.
RFC7519: JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code MAC) and/or encrypted.
- For JWS and JWE, the "JSON" part is the JOSE header because the payload part can be anything and needs NOT to be a JSON object.
- For JWT. As JWT is a special type of JWS/JWE, the header part for sure is JSON object as well. What's more, the payload part ( the claims ) is also required to be JSON object.
No comments:
Post a Comment