RFC 7523 / START HERE
JWT assertions for OAuth, before the details
JWT means JSON Web Token: a compact container for named statements. RFC 7523 explains how those statements can be used in OAuth, the system apps use to request access.
A photo app can bring a signed statement to a token issuer. One statement can support a permission request; another can identify the app. The issuer checks the writer, receiver, subject and usable time before applying its permission policy.
Why it exists
It lets systems use an existing trust agreement when requesting tokens or identifying apps. App login and permission grants are separate jobs; a login statement still needs a grant beside it. This profile does not explain how the app originally obtains the statement.
A familiar example
A trusted system writes that user-17 may request picture access. The photo app submits that statement in a named form field. Changing its subject breaks the signature; addressing another issuer fails a different check. Signing does not hide the contents or automatically make a bearer statement safe from copying.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Two jobs for a signed statementAn app wants a picture token. A statement may support that permission request, identify the app, or do both in separate fields.→
- Put the note in the right pocketThe token endpoint reads named form fields. A correct signature cannot repair a statement sent under the wrong name.→
- Check who sealed the noteAnyone can type a name into a note. The server checks the signed bytes using a key already trusted for that issuer.→
- Check the names on the noteWho wrote it? Who is it about? Which server should receive it? Those are three separate labels.→
- A note has a usable time windowA server clock sits between an optional starting time and a required ending time. An optional identifier book can reject a second use.→
- An optional login is still checked if suppliedThe permission note and the app’s credentials enter separate checks. Making login optional does not make bad credentials acceptable.→
- A sealed note can still be read and copiedA signature detects changes. It does not hide the note or make its bearer the original holder. Permission is a separate decision.→
This introduction explains RFC 7523 (2015). Read the original RFC ↗