2026-09-19 · 8 min read
- jwe
- jwt
- security
JWE can compress plaintext before encryption when a supported zip value is present. Compression belongs to the encrypted-object profile; it does not mean every JWT or JWS payload should be decompressed after Base64url decoding.
Because compression changes both size and processing behavior, an application must decide explicitly whether the token profile permits it. Many small authentication tokens gain little from compression and are simpler to secure when it is disabled.
Define an exact JOSE profile
Specify accepted serializations, key-management algorithms, content-encryption algorithms, zip values, nesting order, issuer and audience rules, and key sources. Enforce these choices from trusted endpoint configuration instead of allowing each token header to choose policy.
- Require zip to be integrity protected.
- Reject unknown or duplicate header parameters.
- Keep JWS, JWE, and nested-token handling distinct.
- Set a small maximum nesting depth.
Order authentication and decompression safely
Let a maintained JOSE implementation parse the envelope, resolve a trusted key, enforce algorithms, and authenticate the ciphertext before the application consumes plaintext. Decompress only according to the authenticated profile and expose output through a bounded interface.
Return uniform external failures for malformed, unauthenticated, and disallowed objects where practical. Detailed differences in timing or errors can become an oracle even when no plaintext is returned.
Enforce limits at every representation
Limit compact or JSON-serialized token length before parsing, protected-header size before key work, ciphertext and decrypted-compressed sizes, decompressed bytes, compression ratio, nesting, and total processing time. A small encrypted blob can otherwise demand excessive memory or CPU.
- Abort streaming output as soon as the expanded limit is crossed.
- Do not allocate from an untrusted advertised size.
- Apply JSON depth and claim-count limits after expansion.
- Record safe reason categories without token contents.
Review confidentiality and conformance
Compression can reveal relationships through ciphertext length when an attacker influences plaintext adjacent to secrets and can observe repeated outputs. Avoid that construction, add padding only when a reviewed protocol defines it, or disable compression.
Use Flashman's JWT, Base64, and JSON tools for disposable structural fixtures, units converter for byte budgets, and diff for profile settings. Test supported and unsupported zip values, high expansion, truncation, altered headers, wrong keys, nested tokens, algorithm rejection, generic errors, and all producer-verifier combinations.