2026-09-13 · 8 min read
- jws
- jwt
- cryptography
A conventional JWS signs an ASCII protected-header segment, a period, and a Base64url-encoded payload segment. RFC 7797 defines an option in which the payload is not Base64url-encoded before signing.
The option can avoid encoding overhead when another protocol already carries the payload, but it changes the signing input and interoperability rules. Use it only inside a profile that explicitly requires or permits it.
Constrain protected header processing
When b64 is false, the parameter must be inside the protected header and b64 must appear in the protected crit array. A verifier that does not implement this critical extension must reject the JWS.
- Allowlist algorithms independently from token input.
- Reject duplicate or malformed protected header names.
- Reject unknown critical parameters.
- Select keys from trusted configuration and issuer context.
Bind the exact payload bytes
For a detached JWS, the application supplies payload bytes from a separate channel. Bind those bytes to the expected message, content type, request context, and signer before using the verification result.
Do not parse and reserialize JSON, normalize Unicode, convert newlines, trim whitespace, or decompress content before constructing the signing input unless the protocol defines that transformation before signing.
Choose serialization deliberately
Compact serialization uses periods as separators, so an attached unencoded payload containing a period cannot be represented safely in that form. Detached compact serialization leaves the payload segment empty but still signs the external bytes.
- Do not interpret every empty payload segment as detached automatically.
- Specify attached versus detached behavior in the profile.
- Set content type when the surrounding protocol requires it.
- Keep ordinary JWT handling separate from this extension.
Use cross-library conformance vectors
Use Flashman's Base64 and JSON tools for public protected-header fixtures, hash for exact payload identities, diff for byte-rendered examples, and JWT tool only for synthetic segment inspection. Production verification belongs in maintained cryptographic libraries.
Test RFC vectors, attached and detached forms, empty payloads, periods, arbitrary bytes, UTF-8, CRLF and LF, missing crit, unprotected b64, unknown critical headers, altered payloads, algorithm rejection, key rotation, and every producer-verifier pair.