Match the payload to its serialization
03Raw content can collide with compact separators or need JSON string processing; detached content has different constraints.
The strings "$.02" and "\u0024.02" both yield the four bytes 36,46,48,50. JSON escape spelling is not a different signed payload.
Source for this drawing: RFC 7797 · Read RFC section 5 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Compact serialization
- Three fields separated by periods.
- JSON serialization
- A JSON object representation of a JWS.
- Octet
- One eight-bit byte.
- Content encoding
- An application representation transformation whose signed form must be specified.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The container determines which raw bytes can travel inside.
- Unencoded non-detached compact payloads MUST NOT contain a period. In URL-safe contexts the application MUST restrict them to letters, digits, dash, underscore and tilde; outside URL-safe contexts, ASCII space and printable ASCII other than period MAY be included if the application can transmit the JWS without modification.
- An unencoded detached payload may contain any octet sequence representable by the application. If using content encoding, the application MUST specify which representation is signed or MACed.
- In JWS JSON Serialization, a non-detached unencoded payload is a JSON string. Process JSON escapes, then encode the resulting code points as UTF-8. Unassigned Unicode code points MUST NOT be used.
- A detached compact JWS has an empty middle field; a detached JSON JWS omits the payload member. In compact payloads percent signs have their literal meaning, not automatic percent-decoding.
H and S in these layout drawings abbreviate the encoded protected header and encoded signature/MAC; they are not complete cryptographic examples. The complete byte/MAC examples are in the preceding chapter. The JSON field shown is a fragment with other JWS members omitted. JSON’s $.02 and \u0024.02 strings yield identical payload bytes. Some unencoded JSON payloads cannot be converted syntactically into a non-detached compact JWS.
Read the RFC section ↗