Category: Standards
-
Certificates in PHP, or what ASN.1 asks of you
X.509 is a data structure before it is a trust model. Reading one properly means meeting ASN.1, DER, and a few decisions made in 1988.
-
CBOR, and why Webauthn insisted on it
A binary format that looks like JSON but is not. If you touch Webauthn, you will meet it, and it helps to know why it is there.
-
Bridging two ecosystems rather than forking one
LexikJWTAuthenticationBundle handles authentication. JWT-Framework handles JOSE. A bridge is a hundred lines; a fork would have been a second project to maintain.
-
Rotating signing keys without breaking anyone
Key rotation is four steps and one waiting period. Skipping the waiting period is what turns a routine operation into an incident.
-
Understanding JSON Web Tokens: verifying properly
A valid signature is the first check, not the last. The claims that must be verified, the ones people forget, and the order to do it in.
-
Understanding JSON Web Tokens: the keys, with JWK
A key format that travels as JSON, key sets you can publish, thumbprints that identify a key by its content, and rotation without downtime.
-
Understanding JSON Web Tokens: signing with JWS
A signature turns two JSON objects into something a recipient can trust. How JWS works, what the three parts of a compact token are, and why the header is protected.
-
Understanding JSON Web Tokens: structure
What a JWT actually is, why the format exists, which standards describe it, and what its two JSON objects contain.