Do not let alg choose the policy
01The receiving application limits acceptable algorithms instead of trusting the token header to decide.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.1 ↗
RFC 8725 · § 3.1EXAMPLE
3 / 3
03
Mismatch rejected
A token claiming an unauthorized algorithm stops before claims are used.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 7519 JWT formatRFC 8725 § 3.1
This BCP updates JWT processing with explicit algorithm verification and per-key algorithm binding to prevent algorithm confusion.
Read the updated RFC section ↗The caller specifies a supported set of algorithms.
- The caller specifies a supported set of algorithms.
- Ensure the algorithm matches the cryptographic operation and key.
- Each key must be used with exactly one algorithm.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy