A JWS header is a JSON object that identifies the algorithm used to sign a JWS. It travels with the payload and signature, helping the recipient verify how the object was protected. section 11.4.1
A compact JWS separates three components with dots:
- Header: Base64 URL-encoded JSON metadata, such as {"alg":"HS256"}. section 11.4.1
- Payload: arbitrary data, which remains readable to anyone who can access the JWS. section 11.4.1
- Signature: a MAC or digital signature used to detect alteration and support authenticity. section 11.4.1
Refund approval between applications
A warehouse application can package refund orders into one refunds.jws file. A payments application reads the header, verifies the signature, rejects altered content, and extracts the payload. Decoding the header reveals {"alg":"HS256"}; the header and payload are readable, not encrypted. section 11.4.3
Figure 11.3 The logical structure of JWS: a JSON metadata header describing the type of signature used, a payload that can be any type of data format, and a signature used to verify that the header and payload weren’t altered. A JWS payload is always readable by anyone who can access the JWS object.
Use the logical structure to distinguish the readable metadata header from the payload and verification signature. section 11.4.1
