Subject: [jose] application/jwt?

From: khali singh <[email-masked]>
Date: Wed, 14 Mar 2012 15:12:06 +0200

Hi Mike and others

I am reading the JOSE drafts. I have a question regarding it. Suppose I
want to sign some random non json data in JWS. Does this mean that the
media type still has to be application/jwt? How does the other party know
how to interpret the payload that I send?

Best Regards
Khali

---

From: Mike Jones <[email-masked]>
Date: Wed, 14 Mar 2012 16:56:33 +0000

Two answers.  First, it may be clear from the application context what the type of the signed content is, so you may need no syntax on the wire to say what it is.  If in the context, you might be sending different kinds of JWS content, in that case, you can use the "typ" header parameter to disambiguate between them.

The media type application/jwt is applicable when sending a JSON Web Token in an HTTP message.  Of course, not all JWSs are JWTs, so in many cases, the media type application/jwt would not apply.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of khali singh
Sent: Wednesday, March 14, 2012 6:12 AM
To: [email-masked]
Subject: [jose] application/jwt?

Hi Mike and others

I am reading the JOSE drafts. I have a question regarding it. Suppose I want to sign some random non json data in JWS. Does this mean that the media type still has to be application/jwt? How does the other party know how to interpret the payload that I send?

Best Regards
Khali

---

From: khali singh <[email-masked]>
Date: Wed, 14 Mar 2012 21:33:58 +0200

Hi

I am not sure if I have understood this clearly. Let's say I am using a
protocol like HTTP/CoAP or some other Restful protocol. Now I would like to
tell the other party that it should interpret the payload as "xyz" by
setting the content-type in the header as application/json or
application/media or so on etc. etc.

Now I want to sign random data, could be a string or could be a structured
object. I can differentiate it by the "typ" in the header of JWS. But how
does the other party know to interpret the payload in the packet as a
JWS/signature in the first place.

I am sort of a newbie so forgive me if I am missing something here?

Best
Khali
On Wed, Mar 14, 2012 at 6:56 PM, Mike Jones <[email-masked]>wrote:

>  Two answers.  First, it may be clear from the application context what
> the type of the signed content is, so you may need no syntax on the wire to
> say what it is.  If in the context, you might be sending different kinds of
> JWS content, in that case, you can use the “typ” header parameter to
> disambiguate between them.****
>
> ** **
>
> The media type application/jwt is applicable when sending a JSON Web Token
> in an HTTP message.  Of course, not all JWSs are JWTs, so in many cases,
> the media type application/jwt would not apply.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *khali singh
> *Sent:* Wednesday, March 14, 2012 6:12 AM
> *To:* [email-masked]
> *Subject:* [jose] application/jwt?****
>
> ** **
>
> Hi Mike and others****
>
> ** **
>
> how to interpret the payload that I send?****
>
> ** **
>
> Best Regards****
>
> Khali****
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 15 Mar 2012 08:47:57 +0000

If the content is not a JWT, there isn't presently a MIME type for describing it.  The MIME types application/jws and application/jwe could be introduced for this purpose if the working feels that this is appropriate and there is a need to do so.  Another possibility is introducing a single MIME type saying that the content follows the JOSE encodings (such as application/jose?), which would require the receiver to then look at the header to determine whether the content is a JWS or JWE.

I'm curious what others think about this issue.

                                                            -- Mike

From: khali singh [mailto:[email-masked]]
Sent: Wednesday, March 14, 2012 12:34 PM
To: Mike Jones; [email-masked]
Subject: Re: [jose] application/jwt?

Hi

I am not sure if I have understood this clearly. Let's say I am using a protocol like HTTP/CoAP or some other Restful protocol. Now I would like to tell the other party that it should interpret the payload as "xyz" by setting the content-type in the header as application/json or application/media or so on etc. etc.

Now I want to sign random data, could be a string or could be a structured object. I can differentiate it by the "typ" in the header of JWS. But how does the other party know to interpret the payload in the packet as a JWS/signature in the first place.

Best
Khali
On Wed, Mar 14, 2012 at 6:56 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
Two answers.  First, it may be clear from the application context what the type of the signed content is, so you may need no syntax on the wire to say what it is.  If in the context, you might be sending different kinds of JWS content, in that case, you can use the "typ" header parameter to disambiguate between them.

                                                            -- Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of khali singh
Sent: Wednesday, March 14, 2012 6:12 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] application/jwt?

Hi Mike and others

Best Regards
Khali