How not to sign a JSON object

Re:How not to sign a JSON object by random023987 on Wednesday July 24, 2019 @04:22PM (#20519248)

Assuming a JWT implementation accepts only a fixed header (all header fields must be present and match, no additional fields can be present), are there any other issues with "just use jwt"?

[ Parent | on HN ]

Re:How not to sign a JSON object by floo on Wednesday July 24, 2019 @06:47PM (#20520821)

I do like using JWT. But its point is to offer flexibility. If you fix the entire header i.e. use a single signature method, you might just as well concat that signature directly.

In other words if you stop utilizing JWT, you won’t have JWT specific problems.

[ Parent | on HN ]

Re:How not to sign a JSON object by lvh on Wednesday July 24, 2019 @06:42PM (#20520772)

Why would you do that? If you already know what the header is, just validate the tag and ignore what the header has to say.

[ Parent | on HN ]