Questions tagged [jws]
JSON web signature (JWS) is a standard for digitally signing data.
6
questions
0
votes
1
answer
113
views
Could the signature of a JWT/JWS be used as a globally unique identifier?
In other words, is a signature on a JWT or JWS always unique?
- 103
1
vote
1
answer
87
views
How to prevent replay attacks with JWE?
I am used to using JWTs so when I needed the same behavior but with no plaintext user data I looked at JWE. JWE is very similar to JWT; however, I did not see the exp, nbf or iat fields which limit ...
- 127
0
votes
2
answers
191
views
Does send HTTP requests as signed tokens make sense when mutual TLS is used?
When we use mTLS, then client and server are authenticated. In this scenario, does it make any sense to send HTTP requests in signed tokens (like JWS)?
- 309
1
vote
1
answer
63
views
JWT forgery by an internal attacker
I have an authorization server that generate JWTs, the JWTs are signed with a private key (RS256) stored on a hardware security module. The tokens are generated only after a successful authentication.
...
- 213
0
votes
1
answer
367
views
Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)
I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time.
I understand that both methods require to prove that the certificate (...
- 173
0
votes
1
answer
815
views
Signing HTTP requests with JWS
Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
