Check who sealed the note
03Anyone can type a name into a note. The server checks the signed bytes using a key already trusted for that issuer.
Decoding makes labels readable; anyone could have typed them.
Offline worked example. Only the public signature/MAC fixtures receive real local cryptographic checks. Other trust, grant, clock and permission inputs are selected teaching cases.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
This checks the exact bytes with the agreed public key or the deliberately public toy shared key. It is separate from trust, names, time and permission checks.
A trusted signature supports trusting these bytes; it does not grant permission by itself.
Key idea: Readable claims are not yet trusted claims.
Terms
- assertion
- A statement another system can check; here it is carried as a JWT.
- authorization grant
- Evidence supporting a request for an access token.
- client authentication
- Checking which app made the request.
- token endpoint
- The server address where an app requests tokens.
- JWT
- JSON Web Token: a compact container for named statements.
- issuer
- The system that created the statement.
- subject
- Who or what the statement is about.
- audience
- The intended receiver of the statement.
- claim
- A named piece of information inside the JWT.
- signature
- A checkable result over bytes made with a secret signing key.
- MAC
- A check over bytes made with a key shared by the parties.
- RS256
- A secret signing key makes a checkable signature; a matching shareable key checks it.
- HS256
- A shared secret lets either party make and check a result over the bytes.
- exp
- Required ending time for using this JWT.
- nbf
- Optional time before which this JWT must not be accepted.
- iat
- Optional time when the JWT was issued.
- jti
- Optional identifier for this JWT; a server may remember it to detect reuse.
- scope
- The named permission requested, such as reading pictures.
- bearer assertion
- A statement usable by someone who possesses it, without proving possession of a separate signing key on each request.
Rules & examples
Readable claims are not yet trusted claims.
These reference examples may differ from the selected experiment.
- The issuer MUST digitally sign the JWT or apply a MAC. Invalid signatures or MACs MUST be rejected, as must JWTs invalid in other respects. Trust, allowed algorithms and keys are agreed outside this exchange. RS256 is mandatory to implement for this profile; it is not the only allowed algorithm or a command to accept any presented algorithm.
Bounded offline examples; crypto fixtures are separate from the selected trust and permission policy.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.