Questions tagged [jws]

JSON web signature (JWS) is a standard for digitally signing data.

Filter by
Sorted by
Tagged with
0 votes
1 answer

Could the signature of a JWT/JWS be used as a globally unique identifier?

In other words, is a signature on a JWT or JWS always unique?
Travis Reeder's user avatar
1 vote
1 answer

How to prevent replay attacks with JWE?

I am used to using JWTs so when I needed the same behavior but with no plaintext user data I looked at JWE. JWE is very similar to JWT; however, I did not see the exp, nbf or iat fields which limit ...
Liam Kelly's user avatar
0 votes
2 answers

Does send HTTP requests as signed tokens make sense when mutual TLS is used?

When we use mTLS, then client and server are authenticated. In this scenario, does it make any sense to send HTTP requests in signed tokens (like JWS)?
Szyszka947's user avatar
1 vote
1 answer

JWT forgery by an internal attacker

I have an authorization server that generate JWTs, the JWTs are signed with a private key (RS256) stored on a hardware security module. The tokens are generated only after a successful authentication. ...
No name's user avatar
  • 213
0 votes
1 answer

Verification of certificate trustworthiness (e.g. in JWS and Client Certificate)

I am comparing implementation complexity of JWS and Client Certificate and troubleshooting Client Certificate at the same time. I understand that both methods require to prove that the certificate (...
user2530062's user avatar
0 votes
1 answer

Signing HTTP requests with JWS

Looking over the spec for JSON Web Signature (JWS), I realise that it doesn't seem to specify anything that is HTTP-specific in terms of the payload. Specifically, signing HTTP headers and bodies (say,...
Michal Charemza's user avatar