98

I've been coding a RESTful service in Java. This is what I've understood till now:

Token authorization is done using JSON Web Tokens (JWT) which have three parts: the header, the payload, and the secret (shared between the client and the server).

I understood this concept and stumbled over JSON Web Signature (JWS) while reading about JWT.

JWS also is an encoded entity similar to JWT having a header, payload, and a shared secret.

What is the difference between the two concepts, namely JWT and JWS? And if they are alike technically, then what's the difference in their implementation?

This is the first time I'm working with token-based authentication, so it's possible I've misunderstood the concept altogether.

P.S.: I learned about JWS while browsing through the examples on this website.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
leo
  • 1,423
  • 2
  • 14
  • 23

2 Answers2

81

JWT actually uses JWS for its signature. From the specification's abstract:

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JavaScript Object Notation (JSON) object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or MACed and/or encrypted.

So a JWT is a JWS structure with a JSON object as the payload. Some optional keys (or claims) have been defined such as iss, aud, exp, etc.

This also means that its integrity protection is not just limited to shared secrets, but public/private key cryptography can also be used.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Hans Z.
  • 50,496
  • 12
  • 102
  • 115
  • Okay that makes sense. So where does my user info go, if the payload contains the claim set? Can you show me an example? – leo Dec 25 '14 at 06:20
  • 1
    please take a look at the examples in Appendix A in the spec here: https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32 – Hans Z. Dec 25 '14 at 08:30
  • The claims will have the user info. Here's an example in code with comments talking about what is going on https://bitbucket.org/b_c/jose4j/wiki/JWT%20Examples – Brian Campbell Nov 12 '15 at 22:43
  • @HansZ. the examples in Appendix A only show JWT. I'm interested in seeing an example of a JWS so I can see the difference between a JWT and a JWS. – David Klempfner Aug 25 '21 at 12:32
23

To put it simply, JWT (JSON Web Token) is a way of representing claims, which are name-value pairs, into a JSON object. The JWT specification defines a set of standard claims to be used or transferred between two parties.

On the other hand, JWS (JSON Web Signature) is a mechanism for transferring a JWT payload between two parties with a guarantee for integrity. The JWS specification defines multiple ways of signing (for example, HMAC or digital signature) the payload and multiple ways of serializing the content to transfer across the network.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Prosunjit Biswas
  • 935
  • 9
  • 16