It took a very long time[1], but JSON Web Signature (JWS) and JSON Web Token (JWT) have finally become Standards Track RFCs[2]. They are [RFC 7515] and [RFC 7519], respectively.
For those who are unfamiliar with it, JWS is a standard for digitally signing JSON. It is the JSON equivalent of XML Signature. There are 2 forms: JSON Serialization and Compact Serialization.
JWT takes a JWS in Compact Serialization and introduces several useful parameter names so that login information and authorization information can be conveyed. It is intended mainly for use in RESTful systems, but of course can also be used elsewhere. Google and Microsoft have already implemented and deployed it on a large scale. You are probably using it without even realizing it. Still, deploying it at scale before it became an RFC… and in Google’s case, putting it into Android means that any changes would have made updates extremely difficult…. I have to admire their courage.
So now that it has officially become an RFC, please feel free to use it without reservation.
[1] JSON Simple Sign dates from 2010, so it took 5 years…. The JOSE WG was formed at the IETF in November 2011; it took an extraordinarily long time.
[2] RFCs have 3 tracks: Informational, Experimental, and Standard. Only the Standards Track is considered a “standard” in the usual sense. Many frequently cited RFCs are actually Informational, so please pay attention to this distinction.
[RFC7515] http://www.rfc-editor.org/info/rfc7515
[RFC7519] http://www.rfc-editor.org/info/rfc7519
Related posts
【Announcement】Is That QR Code Safe? Threats and Countermeasures in Cross-Device Authentication and Authorization Flows【YouTube Live】
On August 22 (Thursday), starting at 20 hours, we will host a YouTube Live stream titled “Is That QR Code Safe? Threats and Countermeasures in Cross-Device…
Authlete Features for OAuth/OIDC Profiling: A Summary
As many of you may know, I serve as an outside director of Authlete Despite that, I had not kept up with the latest developments, so…
On May 19, I Will Deliver a Keynote at EIC 2026 in Berlin, Titled “When Software Becomes Staff: Governance, Security & Safety for Agentic AI”
On the first day of EIC 2026, I will deliver the keynote “When Software Becomes Staff: Governance, Security & Safety for Agentic AI.”
You must be logged in to post a comment.