Tag: JWS
-
Signed, encrypted, or both? Choosing what a JWT should be
A signed token proves who wrote it. An encrypted token hides what it says. They answer different questions, and the answer is not always “both”.
-
Understanding JSON Web Tokens: signing with JWS
A signature turns two JSON objects into something a recipient can trust. How JWS works, what the three parts of a compact token are, and why the header is protected.
-
Algorithm confusion: when alg comes from the wrong header
A single array spread, and the algorithm a verifier trusts came from a header nobody signed. GHSA-jc38-x7x8-2xc8, found and fixed in JWT-Framework.