1.3k VIEWS
Pinterest LinkedIn LINE

ietf-logoIt took a very long time[1], but JSON Web Signature (JWS) and JSON Web Token (JWT) have finally become Standards Track RFCs[2]. They are [RFC 7515] and [RFC 7519], respectively.

For those who are unfamiliar with it, JWS is a standard for digitally signing JSON. It is the JSON equivalent of XML Signature. There are 2 forms: JSON Serialization and Compact Serialization.

JWT takes a JWS in Compact Serialization and introduces several useful parameter names so that login information and authorization information can be conveyed. It is intended mainly for use in RESTful systems, but of course can also be used elsewhere. Google and Microsoft have already implemented and deployed it on a large scale. You are probably using it without even realizing it. Still, deploying it at scale before it became an RFC… and in Google’s case, putting it into Android means that any changes would have made updates extremely difficult…. I have to admire their courage.

So now that it has officially become an RFC, please feel free to use it without reservation.

[1] JSON Simple Sign dates from 2010, so it took 5 years…. The JOSE WG was formed at the IETF in November 2011; it took an extraordinarily long time.
[2] RFCs have 3 tracks: Informational, Experimental, and Standard. Only the Standards Track is considered a “standard” in the usual sense. Many frequently cited RFCs are actually Informational, so please pay attention to this distinction.
[RFC7515] http://www.rfc-editor.org/info/rfc7515
[RFC7519] http://www.rfc-editor.org/info/rfc7519

Related posts