I don't know if this is intended or not, but when I create a new token like documentation says:
String token = JWT.create()
.withIssuer("auth0")
.sign(Algorithm.HMAC256("secret"));
There is no type field on header, I haven't tried other algorithms but I think it should be the same.
In the example of jwt.io there is a 'typ' field on headers.
Some places say you should check type to prevent tokens that you don't expect, I know this doesn't improve security, it's just a filter to discard malicious tokens. Anyway I'm curious about type tag.
I don't know if this is intended or not, but when I create a new token like documentation says:
There is no type field on header, I haven't tried other algorithms but I think it should be the same.
In the example of jwt.io there is a 'typ' field on headers.
Some places say you should check type to prevent tokens that you don't expect, I know this doesn't improve security, it's just a filter to discard malicious tokens. Anyway I'm curious about type tag.