4

In authentication, the term 'claim' is used to describe elements like user identity that has not yet been challenged and verified. My understanding is that a 'claim' typically refers to something that has not yet been verified as either true or false.

This makes sense during the authentication process, where a user's claimed identity needs to be validated.

However, in other contexts, such as contexts involving JWTs, where tokens are issued by a trusted authority and carry signed assertions, why do we still refer to the information within these tokens as 'claims'? If the JWT is valid and from a trusted source, why does the term 'claim' continue to imply a need for verification?

10
  • 2
    I think JSON Web Token (JWT) claims are called "claims" because they represent assertions or statements made by the issuer (usually a server) about the subject (usually a user.) Commented May 9 at 7:42
  • 1
    en.wikipedia.org/wiki/JSON_Web_Token links to en.wikipedia.org/wiki/Claims-based_identity Does that answer you?
    – schroeder
    Commented May 9 at 7:55
  • well the signature does need to be validated... so "claims" is probably a very good term to use. Commented May 9 at 20:57
  • @browsermator The signature only proves that the claims have been made by the issuer. They don't confirm the claims themselves. Those are typically just trusted.
    – Ja1024
    Commented May 9 at 23:45
  • Signatures are also optional in JWT.
    – Ja1024
    Commented May 10 at 8:15

1 Answer 1

7

The same term can have different meanings in different contexts. It's true that in everyday language, the term “claim” may imply that a statement hasn't (yet) been verified. The Cambridge Dictionary even defines the verb as

to say that something is true or is a fact, although you cannot [sic!] prove it and other people might not believe it

However, in the actual JWT specification, “claim” isn't used in this sense at all. It's simply defined as:

Claim: A piece of information asserted about a subject. A claim is represented as a name/value pair consisting of a Claim Name and a Claim Value.

That's it. The term as used by JWT doesn't imply the need for verification. In fact, JWT claims generally cannot be verified, because the receiver of the JWT token doesn't have the information conveyed through the token -- if it did, there would be no need for JWT. The receiver trusts the token issuer to provide correct information. All it has to (and can) check is that the token has in fact been produced by the issuer and not changed afterwards, e.g., by verifying the JWS signature.

Of course the authors of the JWT specification could have chosen a different term which isn't quite as “loaded”. But in IT security, this is a common term to denote a statement made by some authority (see, for example, schroeder's link to Claims-based identity).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .