JWS
acronymcryptographysecurity
Stands for: JSON Web Signature
A standard for signing data represented as JSON.
JSON Web Signature (RFC 7515) defines how to sign a payload and encode the signature compactly. It underlies signed JWTs; notably its 'none' algorithm, meant for unsecured tokens, is a classic source of verification bugs.
JSON Web Signature is the signing half of the JOSE family and the structure underneath a signed JWT: a header, a payload and a signature, base64url encoded and joined by dots.
Its recurring danger is the algorithm field in the header, which describes what the sender used and must never be what the receiver trusts. Accepting the header's claim allows the none algorithm and the RS256-to-HS256 confusion attack. The correct implementation fixes the acceptable algorithm out of band and rejects anything else, and libraries that made this the default rather than an option removed a whole class of vulnerability from the ecosystem.
Also known as: jws