2 ms·
You can have unsigned, signed, or encrypted JWTs. You're correct that many JWT libraries only do signed tokens by default, but there's a whole spec devoted to e
by ForHackernews 8y ago
You can have unsigned, signed, or encrypted JWTs. You're correct that many JWT libraries only do signed tokens by default, but there's a whole spec devoted to encryption: https://tools.ietf.org/html/rfc7516 https://tools.ietf.org/html/rfc7516 (whether or not your library of choice implements it is a separate question)
- andrewstuart2 8y agoThis is one of the things I truly appreciate about JWT. They made it a) easy and b) possible to do signing, encryption, or both. If you've ever taken a shot at learning the specs behind SAML, the simplicity of JWT is hugely refreshing.
- Freak_NL 8y agoI wholeheartedly agree. I've had the opportunity to use both implementing a single sign-on solution with an ADFS server, and it is quite interesting to see how OpenID Connect and JWT basically do what SAML and the ADFS SSO authentication flow do; just with a much, much smaller payload and a way more accessible standard. Also, finding information and documentation on JWT and related technologies on-line is a lot easier.
- nwhatt 8y agoThank you for comparing it to SAML. I feel like anytime JWT is mentioned on HN people jump to discard it as rubbish, but really it's useful for people who actually need to exchange claims.