HS256 is the JOSE identifier for HMAC using SHA-256. It signs JWS content with a shared secret so recipients can detect tampering and authenticate its source; it does not encrypt the payload. section 11.1 section 11.4.1
A signed HS256 JWS contains:
- A header naming HS256, a readable payload, and a signature computed from the header and payload. section 11.4.1
- A shared secret that both signing and verifying applications must possess. section 11.4.2
- Base64 URL-encoded components separated by dots for use in HTTP headers or URL parameters. section 11.4.1
Java with Nimbus
Create a JWS with JWSAlgorithm.HS256 and MACSigner, then parse it and call verify with MACVerifier. Keep the secret outside source code and properties files. section 11.4.2
Listing 11.2 Creating a JWS object and signing it using a secret key
public final class JwsUtil {
private static final byte[] HMAC_SECRET =
Base64.getDecoder().decode(
"VGhpc0lzQS1EZW1vLVNlY3JldC1LZXk
➥tRm9yLUhTMjU2LUF0TGVhc3QtMzJCeXRlcyE="
);
public static String generateJws(
String payloadJson) throws JOSEException {
JWSHeader header = #1
new JWSHeader.Builder(JWSAlgorithm.HS256) #1
.contentType("application/json") #1
.build(); #1
JWSObject jwsObject = #2
new JWSObject(header, new Payload(payloadJson));
jwsObject.sign(new MACSigner(HMAC_SECRET)); #3
return jwsObject.serialize(); #4
}
}
Shows the compact Java signing flow, from HS256 header construction through serialization. section 11.4.2
