A JWS payload is the content carried by a JSON Web Signature. It can be arbitrary data, including a string or JSON, and remains readable to anyone who can access the JWS. The signature helps detect changes; it does not provide confidentiality. section 11.4.1 section 11.8
Handle a payload with these distinctions:
- Place it between the JWS header and signature, with the three components separated by dots. section 11.4.1
- Encode it with Base64 URL encoding before embedding the JWS in an HTTP header or URL parameter. section 11.4.1
- Verify the complete JWS before trusting the payload, and reject unsafe algorithm choices such as alg:none. section 11.4.2
An order-refund payload
A warehouse application can sign a JSON array such as [{"orderId":"12345","amount":500},{"orderId":"56789","amount":250}]. In the compact JWS, its encoded representation is the middle component. Nimbus creates it with Payload(payloadJson) and verifies the surrounding JWS before accepting it. section 11.4.1 section 11.4.2
Figure 11.3 The logical structure of JWS: a JSON metadata header describing the type of signature used, a payload that can be any type of data format, and a signature used to verify that the header and payload weren’t altered. A JWS payload is always readable by anyone who can access the JWS object.
Use the structure diagram to distinguish readable payload data from the header metadata and signature used for verification. section 11.4.1
