My spec called the same token a JWS and a JWT. Both were right, and it took me a while to see why.

Description and use

The author clarified the difference between JWS and JWT, created a secure Delegation Pass, and implemented strict verification with a unique typ and an allow‑list of algorithms.

Problem

The author was confused about whether a signed token was a JWS or a JWT, leading to potential security misunderstandings.

Outcome

The author resolved the confusion between JWS and JWT, implemented a secure Delegation Pass with strict verification, and documented the process.

Workflow

• Define Delegation Pass as a signed token carrying order permissions.
• Write the pass as a JWS in compact form with a JWT payload.
• Read RFC 7515 (JWS) and RFC 7519 (JWT) to understand the difference.
• Implement verification that checks typ and alg against an allow‑list before verifying the signature.
• Use a unique typ ("awl-pass+jwt") to distinguish passes from other JWTs.
• Verify signature with the issuer’s public key, then check exp, iat, iss, sub, aud before using claims.
• Renew passes while the order is active and stop renewal when the order is cancelled.
• Use WebCrypto for signing and verifying across Node, browsers, Deno, and Bun.

Evidence

Every signed JWT is a JWS. Not every JWS is a JWT.

Source

The header is chosen by whoever made the token, and it's checked before you know whether the signature is any good.

Source

A unique typ like awl-pass+jwt closes that off.

Source