Visual RFC.
ALL RFCs / RFC 7797
Read the RFC ↗

RFC 7797 / START HERE

Unencoded JWS payloads, before the details

JWS means JSON Web Signature. This option lets a suitable application leave payload bytes unencoded; JSON means JavaScript Object Notation.

A JWS protects content with a signature or a Message Authentication Code (MAC). This RFC lets the protected header choose raw payload bytes instead of base64url text for that computation.

Start the guide See the 5 chapters ↓

The idea in one picture

  1. Choose the encoding policy

  2. Protect exact payload bytes

  3. Check before content use

A simplified picture of the idea; the chapters explain the actual mechanisms.

Why it exists

Large detached documents may already travel between applications without modification. Avoiding an extra encoded copy can reduce copying, storage and computation, while preserving the exact signed bytes.

A familiar example

A document service sends content separately with an integrity tag. It must agree on byte representation, understand the critical encoding choice and follow serialization restrictions. JWTs cannot use this option.

Helpful background

You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.

JWSRFC 7515 · beginner overview ↗Base encodingsRFC 4648 · beginner overview ↗JWTRFC 7519 · beginner overview ↗

What you’ll learn next

Begin with chapter one, or choose a topic.

  1. Choose which payload bytes enter the MACThe protected b64 header chooses whether signing uses base64url text or the payload octets themselves.
  2. Reproduce the RFC’s four-byte exampleTwo public HMAC examples use the same four-byte payload but different protected headers and signing inputs.
  3. Match the payload to its serializationRaw content can collide with compact separators or need JSON string processing; detached content has different constraints.
  4. Require understanding before using the contentcrit makes the encoding extension mandatory to understand, preventing a valid tag from hiding different payload interpretations.
  5. Set one application policy and exclude JWTsApplications choose consistent encoding behavior, multiple signatures must agree, and JWTs cannot use the unencoded option.
Start with chapter one →

This introduction explains RFC 7797 (2016). Read the original RFC ↗