search

oauth-wg / oauth-transaction-tokens

MIT License
7 stars 10 forks source link

Typ header parameter being misused in TraTs draft #97

Closed tulshi closed 4 weeks ago

tulshi commented 1 month ago

According to the RFC 7515 (JWS), the "typ" header parameter is supposed to indicate a media-type (https://www.iana.org/assignments/media-types/media-types.xhtml). In addition, the JWT spec section 5.1 clarifies that if used, it should be set to "JWT". However, the TraTs draft requires this to be set to "txn_token". This is clearly not right. We need to find another way to identify a JWT to be a TraT.

bc-pi commented 1 month ago

see also https://www.rfc-editor.org/rfc/rfc8725.html#name-use-explicit-typing https://datatracker.ietf.org/doc/html/rfc9068#name-header https://www.rfc-editor.org/rfc/rfc9449.html#name-dpop-proof-jwt-syntax

tulshi commented 1 month ago

Thanks for these references. I will go with "txntoken+jwt" for now, based on the recommendation of the "Explicit Typing" section.