I'm working in a project that the client must encrypt the HTTP messages payload to send to the server. In my first research I found the RFC 8188 and I think it solve my problem, but some people suggest the use of the JWE to encrypt the payloads. Does it make sense use JWE to encrypt HTTP payloads?

  • 3
    Could you be more specific about the requirements? From what you've said I can't tell why you wouldn't just use HTTPS. – AndrolGenhald Feb 23 '19 at 18:10
  • This is a client's requirement, they need to transport the encrypted payload messages over HTTP or HTTPS. I think that the requirement comes from here – Humberto Corrêa Feb 24 '19 at 14:54

RFC 8188, JWE, XML encryption, PGP .... are all basically container formats to store and/or transport encrypted information together with some meta information like the encryption algorithm and others. All of these allow you to encrypt the HTTP payload - which is is the only requirement you've provided in your question. But which of the various methods is best for your specific use case depends on the specific details of your use case which are not known to us.


Unless you have some very specific requirements that you haven't described in your question, ECE and JWE are unlikely to be appropriate for your application.

HTTP traffic is conventionally encrypted using TLS, as HTTPS. Other options should only be considered if there is a very specific reason why HTTPS is insufficient.

  • Yes, I agree. I think that the HTTPS is not sufficient on the case of our client. They need an extra layer of protection in the case of HTTPS violations. – Humberto Corrêa Feb 24 '19 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.