I'm working in a project that the client must encrypt the HTTP messages payload to send to the server. In my first research I found the RFC 8188 and I think it solve my problem, but some people suggest the use of the JWE to encrypt the payloads. Does it make sense use JWE to encrypt HTTP payloads?

  • 3
    Could you be more specific about the requirements? From what you've said I can't tell why you wouldn't just use HTTPS. Feb 23, 2019 at 18:10
  • This is a client's requirement, they need to transport the encrypted payload messages over HTTP or HTTPS. I think that the requirement comes from here Feb 24, 2019 at 14:54

2 Answers 2


RFC 8188, JWE, XML encryption, PGP .... are all basically container formats to store and/or transport encrypted information together with some meta information like the encryption algorithm and others. All of these allow you to encrypt the HTTP payload - which is is the only requirement you've provided in your question. But which of the various methods is best for your specific use case depends on the specific details of your use case which are not known to us.


Unless you have some very specific requirements that you haven't described in your question, ECE and JWE are unlikely to be appropriate for your application.

HTTP traffic is conventionally encrypted using TLS, as HTTPS. Other options should only be considered if there is a very specific reason why HTTPS is insufficient.

  • Yes, I agree. I think that the HTTPS is not sufficient on the case of our client. They need an extra layer of protection in the case of HTTPS violations. Feb 24, 2019 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .