Subject: [jose] JWT header "typ" parameter

From: "Vladimir Dzhuvinov / NimbusDS" <[email-masked]>
Date: Tue, 20 Mar 2012 04:45:29 -0700

Hi guys,

I'm working on a JWT implementation for Java and I'm very pleased with
this effort to standardise the messages.

http://tools.ietf.org/html/draft-jones-json-web-token-08#section-5 says
that the "typ" declares the structure of the JWT and that if specified
and the token is not nested, its value should be "JWT" or the equivalent
URL.

My implementation approach has been to emphasise type safety and make
use of enums where possible. "typ" seems like a candidate for enum, but
I hesitate because of the RECOMMENDED tag. Why is the "typ":"JWT" value
RECOMMENDED and not a MUST? Are there going to be situations when the
JWT isn't actually going to be a JWT?

Cheers,

Vladimir

--
Vladimir Dzhuvinov : www.NimbusDS.com : [email-masked]

---

From: John Bradley <[email-masked]>
Date: Tue, 20 Mar 2012 12:29:25 -0300

The value of typ is JWS if the content is a JWS and likewise JWE if the content is a JWE.

The value of typ is JWT to indicate the content is a a JSON object expressing JWT semantics.  
The content could be a SAML assertion or anything else.  Leading people to extend typ

I think the new JOSE JWE & JWS drafts may help.
http://tools.ietf.org/html/draft-ietf-jose-json-web-signature
http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption

So the short answer is that JWS and JWT can be used to secure any content.
In many cases that content is a JWT security token.

The JWT spec is about the case where the content is a JWT so is less generic than the 
JWS & JWE specs.

In hope that helps.
John B.

On 2012-03-20, at 8:45 AM, Vladimir Dzhuvinov / NimbusDS wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose