Blog

JWT in Depth: JWS and JWE, Algorithm Choice, kid, JWKS and Signing Key Rotation

Seamless signing key rotation takes three steps: publish the new key in the JWKS, wait until the APIs' caches refresh (12 hours by default), then sign with it and retire the old key once token lifetimes pass. We show JWS versus JWE, choosing ES256, alg none and algorithm confusion attempts, typ validation with at+jwt, kid and JWKS, the 8725bis draft's warnings and claim bloat with real outputs.