What is the mime type to use for JSON Web Encryption

Question

Looking at RFC 7515 and RFC 7516, I was trying to understand what the proper mime type for the JWE should be. It looks like JWE and JWS share the JOSE header information, and JWS defines its mime type as application/jose. JWE has no explicit media type information. But since the name is "jose" and both use JOSE header, I assume both should use the same mime type (also because JOSE stands for ... Signing and Encryption).

In this case, how do I differentiate between signed and/or encrypted messages? By value of the alg property? Or by presence/value of enc property?

To summarize:

Is "application/jose" a mime type to use for JWE? If not, then what should it be?
If yes, how to reliably tell between JWE and JWS messages?

RFC7519#section-10.3.1 indicates the mime type is application/jwt. — Spomky-Labs
– Spomky-Labs, Commented Dec 21, 2017 at 7:46
@FlorentMorselli That's for JWT, my concern was between JWE and JWS only. — Pawel Veselov
– Pawel Veselov, Commented Dec 21, 2017 at 15:09
There is no mime type to distinguish JWS and JWE. It is up to the service that receive the token to handle the token type (see tools.ietf.org/html/rfc7516#section9 you mentioned) — Spomky-Labs
– Spomky-Labs, Commented Dec 21, 2017 at 16:33
In any case, nothing prevents you from using your own mime type — Spomky-Labs
– Spomky-Labs, Commented Dec 21, 2017 at 17:06
What's the difference between application/jwt and application/jose? — CMCDragonkai
– CMCDragonkai, Commented Oct 21, 2022 at 5:51

Community · Accepted Answer · 2021-10-07 10:55:51Z

5

If I only paid more attention to the original RFC, I would have noticed that there is a section for this particular purpose (section 9).

In short, the code should examine presence of payload, ciphertext or enc properties, or by checking the value of alg. Alternatively, count period separators if compact serialization is used.

This also implies that the mime type for both is the same.

edited Oct 7, 2021 at 10:55

CommunityBot

11 silver badge

answered Mar 29, 2017 at 23:13

Pawel Veselov

4,2738 gold badges50 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

What is the mime type to use for JSON Web Encryption

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related