JSON Web Token Best Current Practices

Metadata

Publisher: IETF
Doc Type: Best Practice
Pages: 13
Abstract: JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted. JWTs are being widely used and deployed as a simple security token format in numerous protocols and applications, both in the area of digital identity and in other application areas. This Best Current Practices document updates RFC 7519 to provide actionable guidance leading to secure implementation and deployment of JWTs.
Publication Date: 2020-02-01
Status Note: Best Current Practice
DOI: 10.17487/RFC8725
Link: https://doi.org/10.17487/RFC8725
Author(s): Yaron Sheffer
Dick Hardt
Michael B. Jones
Keyword(s): JWT, JOSE, JWS, JWE, Security, Cryptography

Latest version of IETF RFC 8725

Document Versions — IETF RFC 8725

▶ IETF RFC 8725 (2020-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST.SP.800-56Ar3 — KEYAGREEMENT EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 6979 [Active*]
IETF RFC 7515 [Active*]
RFC7516 — JWE EXTERNAL
RFC7518 — JWA EXTERNAL
IETF RFC 7519 [Active*]
IETF RFC 8017 [Active*]
RFC8037 — RFC8037 EXTERNAL
IETF RFC 8174 [Active*]
IETF RFC 8259 [Active*]

Bibliographic Reference(s)

10.1007-3-540-45661-9_21 — Kelsey EXTERNAL
10.1007-978-3-662-47854-7_6 — Alawatugoda EXTERNAL
ANSI.X9.62.2005 — X9.62-2005 EXTERNAL
Sakimura, N., Bradley, J., Jones, M., de Medeiros, B., and C. Mortimore, "OpenID Connect Core 1.0 incorporating errata set 1", November 2014, <https://openid.net/specs/openid-connect-core-1_0.html>. EXTERNAL
Langkemper, S., "Attacking JWT authentication", September 2016, <https://www.sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication/>. EXTERNAL
Sanso, A., "Critical Vulnerability Uncovered in JSON Encryption", March 2017, <https://blogs.adobe.com/security/2017/03/critical-vulnerability-uncovered-in-json-encryption.html>. EXTERNAL
Valenta, L., Sullivan, N., Sanso, A., and N. Heninger, "In search of CurveSwap: Measuring elliptic curve implementations in the wild", March 2018, <https://ia.cr/2018/298>. EXTERNAL
NIST, "CVE-2015-9235 Detail", National Vulnerability Database, May 2018, <https://nvd.nist.gov/vuln/detail/CVE-2015-9235>. EXTERNAL
McLean, T., "Critical vulnerabilities in JSON Web Token libraries", March 2015, <https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/>. EXTERNAL
IETF RFC 6749 [Active*]
IETF RFC 7159 [Superseded*]
RFC7517 — JWK EXTERNAL
RFC8414 — RFC8414 EXTERNAL
RFC8417 — RFC8417 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8725.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 8725, JSON Web Token Best Current Practices. Available at https://doi.org/10.17487/RFC8725

Snippet:

IETF RFC 8725, JSON Web Token Best Current Practices. Available at https://doi.org/10.17487/RFC8725

HTML (ISO 690 compliant)

Preview:

IETF RFC 8725, JSON Web Token Best Current Practices. Available at https://doi.org/10.17487/RFC8725

Snippet:

<span class="citation"><cite>IETF RFC 8725</cite>, JSON Web Token Best Current Practices. Available at <a href="https://doi.org/10.17487/RFC8725" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8725</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 8725, JSON Web Token Best Current Practices
doi: 10.17487/RFC8725
url: https://doi.org/10.17487/RFC8725

Snippet:

<li>
<cite id="bib-rfc8725">IETF RFC 8725</cite>, JSON Web Token Best Current Practices
<span class="doi">10.17487/RFC8725</span>
</li>

Referenced By

IETF RFC 9725 [Active*]