Skip to content

No token type #136

Description

@zalito12

I don't know if this is intended or not, but when I create a new token like documentation says:

String token = JWT.create()
    .withIssuer("auth0")
    .sign(Algorithm.HMAC256("secret"));

There is no type field on header, I haven't tried other algorithms but I think it should be the same.
In the example of jwt.io there is a 'typ' field on headers.
Some places say you should check type to prevent tokens that you don't expect, I know this doesn't improve security, it's just a filter to discard malicious tokens. Anyway I'm curious about type tag.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions