The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that needs to be protected) and sends the serialized output as the response to a REST API request, over HTTPS, to the client. The client application uses the library's corresponding decryption function to decrypt the response. Since the same code library is used, both sides understand that the response body is a string in JWE Compact Serialization format. However, the applications on both sides do not need to know anything about the contents or its format. They just call the library's methods.
My question is: After getting the output from the encryption function, is it correct for the application on the server-side to stream it to the client with
Content-Type header set to
application/octet-stream? Since this is the most generic content type, I think it should be OK because the application does not care about the format of the output from the encryption function. Is this the standard practice or is there some other recommended / preferred / correct value for
Content-Type of a response whose body is a string in JWE Compact Serialization format?
I found the specific media type
application/jose as registered in the IANA Registry of media types to identify content that is a JWS or JWE object using the JWS Compact Serialization or the JWE Compact Serialization:
However, I would still like to confirm that, if both sides agree that the content is to be interpreted as a JWE object, then sending
Content-Type: application/octet-stream will not cause any issue.