My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload.

Regarding jwt, I have questions:

  1. if jwt uses http heeder authorization, does it mean i cant use http basic(or digest) as first layer security?

  2. is it possible to put jwt in the message payload just like soap does?

Thanks in advance.

2 Answers 2


Depends how much you can deviate from specification.

As HTTP standard authentication token is being passed in Authorization header. But nothing prevents you from using this token somewhere else. Recently I worked with application where JWT was inside cookie, so nothing prevents you from delivering token as part of message body.

  1. I’m not sure why you’d want to use basic auth and JWTs. A JWT is a token that has already abstracted out the username/password combo for you, to further add username/password in basic auth is unnecessary, and introduces an attack surface. Once you use JWTs, don’t store the username/password client side.

  2. I haven’t read all the RFCs on JWTs, but technically it’s feasible to pass the token via the body as well. Although, the preferred method is via a http Authorization header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .