My spec called the same token a JWS and a JWT. Both were right, and it took me a while to see why.

说明与用途

作者澄清了 JWS 与 JWT 的区别，创建了安全的 Delegation Pass，并实施了严格的验证，包括唯一的 typ 和允许的算法列表。

问题

The author was confused about whether a signed token was a JWS or a JWT, leading to potential security misunderstandings.

结果

The author resolved the confusion between JWS and JWT, implemented a secure Delegation Pass with strict verification, and documented the process.

工作流

• Define Delegation Pass as a signed token carrying order permissions.
• Write the pass as a JWS in compact form with a JWT payload.
• Read RFC 7515 (JWS) and RFC 7519 (JWT) to understand the difference.
• Implement verification that checks typ and alg against an allow‑list before verifying the signature.
• Use a unique typ ("awl-pass+jwt") to distinguish passes from other JWTs.
• Verify signature with the issuer’s public key, then check exp, iat, iss, sub, aud before using claims.
• Renew passes while the order is active and stop renewal when the order is cancelled.
• Use WebCrypto for signing and verifying across Node, browsers, Deno, and Bun.

证据

Every signed JWT is a JWS. Not every JWS is a JWT.

来源

The header is chosen by whoever made the token, and it's checked before you know whether the signature is any good.

来源

A unique typ like awl-pass+jwt closes that off.

来源