Protected and unprotected headers
03JWS JSON serialization can carry header values outside the signature’s protection.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.2 ↗
RFC 7515 · § 3.2EXAMPLE
3 / 3
03
Consumer policy
Do not treat unprotected metadata as authenticated instructions.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
The protected header is integrity protected.
- The protected header is integrity protected.
- The unprotected header is not covered by that signature.
- Header parameter names in the combined header must be disjoint.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy