Search code examples
samlspecificationsjwtjson-web-token

Is the JOSE Header a mandatory part of a JWT token

I am looking at adding JWT ability to a token generation system which is currently supporting SAML with our own signature and custom algorithm. In this case, should we always have the JOSE Header for the token or can we generate just the JWT with the Claims alone.

Solution

  • A JWT as sent on the wire in its compact serialized representation must always include a header, but if you don't sign the JWT, that header can be set to the base64encoded value of {"alg":"none"}.

    However if you want to send it between two systems that you control and implement, you could only sent the payload JSON object, i.e. the JWT Claims Set. Of course you would then not be able to parse it using a JWT library, but you'd treat it like any other JSON object with a plain JSON parser.