What is "at+jwt" in the header of my JWT?

user_1525840 0
Viewed 1113

I've seen the header of a few tokens looking like this.

{
  "alg": "HS256",
  "typ": "at+jwt"
}

It's not clear to me what the at stands for nor what it implies. Checking the docs didn't tell me much. Googling the thing is a bit difficult because the keyword is treated as a preposition. So, not many relevant hits there neither.

Is it something specific to IDS4 (which is the framework we're using to create our tokens)? It's not apparently documented there neither but that's the usual state of things. I wouldn't assume that because I've seen it mentioned in the context of Spring but I'm too uncertain to tell.

jwt
1 Answers

https://datatracker.ietf.org/doc/html/rfc9068

This specification registers the "application/at+jwt" media type, which can be used to indicate that the content is a JWT access token. JWT access tokens MUST include this media type in the "typ" header parameter to explicitly declare that the JWT represents an access token complying with this profile. Per the definition of "typ" in Section 4.1.9 of [RFC7515], it is RECOMMENDED that the "application/" prefix be omitted. Therefore, the "typ" value used SHOULD be "at+jwt". See the Security Considerations section for details on the importance of preventing OpenID Connect ID Tokens (as defined by Section 2 of [OpenID.Core]) from being accepted as access tokens by resource servers implementing this profile.

See also https://datatracker.ietf.org/doc/html/rfc9068#section-4 for how you must validate tokens following this profile.

user_97758820
Related