<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>The classic OIDC appears to be no longer the hot topic here, but
I want to inform the WG that after resisting pressure from users
for some time we recently started supporting explicitly typed ID
tokens and UserInfo JWTs, the rationale being the prevention of
mix ups in applications with many types of JWTs floating around,
plus making it easier for code and people to determine the JWT
purpose by simply examining the "typ" (type) header and not having
to analyze the claims structure.<br>
</p>
<p>By explicit JWT typing I mean use of the optional "typ" header in
a JWT, something the JWT profile for access tokens for instance
uses (and other OAuth related specs that carry JWTs).</p>
<pre><code class="json hljs">{
<span class="hljs-attr">"kid"</span> : <span class="hljs-string">"1"</span>,
<span class="hljs-attr">"alg"</span> : <span class="hljs-string">"RS256"</span>,
<span class="hljs-attr">"typ"</span> : <span class="hljs-string">"id_token+jwt"</span>
}</code></pre>
<pre><code class="json hljs">{
<span class="hljs-attr">"kid"</span> : <span class="hljs-string">"1"</span>,
<span class="hljs-attr">"alg"</span> : <span class="hljs-string">"RS256"</span>,
<span class="hljs-attr">"typ"</span> : <span class="hljs-string">"userinfo+jwt"</span>
}</code></pre>
<p><br>
</p>
<p>I know this is non-standard and may likely break existing
validation code and client libraries. If you have thoughts or
feedback about this typing, good or bad, I'd love to hear it.<br>
</p>
<p>Vladimir<br>
</p>
<pre class="moz-signature" cols="72">--
Vladimir Dzhuvinov</pre>
</body>
</html>