search

paseto-standard / paseto-spec

Specification for Platform Agnostic SEcurity TOkens (PASETO)
208 stars 12 forks source link

Support for Non-JSON Formatted Payload #40

Open justkash opened 1 month ago

justkash commented 1 month ago

Should PASETO be agnostic to the formatting of the payload? Is there a strong reason why JSON payloads are preferred?

paragonie-security commented 1 month ago

We went with JSON because it was convenient, especially for developers that would otherwise reach for JWTs.

Other encodings are tentatively permitted by the spec, should anyone care to specify them. We even called out v3c / v4c as a potential header for "CBOR".

But we don't use anything other than JSON in our own projects, so we haven't felt a need to specify it.