0

Is it possible to use the last (signature) part or any other part or combination of parts of a JWT token as a kind of public key. This would allow the client to sign a message such that only the JWT generator who has the private key would be able to decrypt and understand the message.

Is this possible?

If so is there an example I can look at?

PaulProgrammer
  • 16,175
  • 4
  • 39
  • 56
Anters Bear
  • 1,816
  • 1
  • 15
  • 41

1 Answers1

1

This is called "JWE" - json web encryption, and is part of a standard implementation RFC-7516.

No need to write your own libraries even - JWE is supported by many of the JWT implementations out there, which as a suite are referred to as JOSE (Json Object Signing and Encryption).

There are many examples of JWE implementations out there. I'm not sure which platform you're working with, but in abstract here's a link to what a JWE might look like, and here's a basic implementation using JavaScript.

PaulProgrammer
  • 16,175
  • 4
  • 39
  • 56