JWS protects integrity and supports source authentication; JWE carries encrypted content. Dot-separated token fields are not necessarily confidential.
Evaluation approach
Choose accepted algorithms and keys from trusted policy. Avoid unnecessary personal claims.
Application example
A signed token containing a role may be readable. Do not depend on that role remaining secret.
Limits and considerations
The token format does not enforce access rights; consumers must validate and authorize.
Who chooses the algorithm?
A token header must not independently set acceptance policy. Restrict methods through trusted configuration and reject unknown choices rather than silently downgrading.
Checks and decisions
- Choose the intended format
- Minimize claims
- Restrict algorithms
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.