RFC 8725: JSON Web Token Best Current Practices

JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted. JWTs are being…

Read RFC 8725 on the RFC Editor

Outgoing relationships (15 related RFCs)

Updates, Normative reference — RFC 7519: JSON Web Token (JWT)
Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Normative reference — RFC 8259: The JavaScript Object Notation (JSON) Data Interchange Format
Normative reference — RFC 7515: JSON Web Signature (JWS)
Normative reference — RFC 8017: PKCS #1: RSA Cryptography Specifications Version 2.2
Normative reference — RFC 7518: JSON Web Algorithms (JWA)
Normative reference — RFC 7516: JSON Web Encryption (JWE)
Normative reference — RFC 6979: Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)
Normative reference — RFC 8037: CFRG Elliptic Curve Diffie-Hellman (ECDH) and Signatures in JSON Object Signing and Encryption (JOSE)
Informative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Informative reference — RFC 7159: The JavaScript Object Notation (JSON) Data Interchange Format
Informative reference — RFC 7517: JSON Web Key (JWK)
Informative reference — RFC 8414: OAuth 2.0 Authorization Server Metadata
Informative reference — RFC 8417: Security Event Token (SET)

Incoming relationships (9 related RFCs)

Normatively referenced by — RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
Normatively referenced by — RFC 9447: Automated Certificate Management Environment (ACME) Challenges Using an Authority Token
Normatively referenced by — RFC 9448: TNAuthList Profile of Automated Certificate Management Environment (ACME) Authority Token
Normatively referenced by — RFC 9701: JSON Web Token (JWT) Response for OAuth Token Introspection
Normatively referenced by — RFC 9770: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework
Normatively referenced by — RFC 9901: Selective Disclosure for JSON Web Tokens
Informatively referenced by — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Informatively referenced by — RFC 9246: URI Signing for Content Delivery Network Interconnection (CDNI)
Informatively referenced by — RFC 9943: An Architecture for Trustworthy and Transparent Digital Supply Chains