Intermediate LevelAuthentication & Authorization
What is a Nested JWT (JWE containing a signed JWS) and when is it required?
❓ Interview Prompt: Compare JSON Web Signature (JWS - signed) vs JSON Web Encryption (JWE - encrypted) vs Nested JWTs.
Standard JWTs are JWS (JSON Web Signature) objects: signed to guarantee integrity, but Base64Url un-encrypted! If claims contain sensitive PII (SSNs, medical data), using plain JWS leaks data.
Nested JWT Architecture (Signed THEN Encrypted):
1
Inner JWS: Payload claims are signed with the issuer's Private Key (guaranteeing authenticity).
2
Outer JWE: The signed JWS is then encrypted using the recipient's Public Key (guaranteeing confidentiality).
3
Result: Only the intended recipient holding the private decryption key can un-encrypt and verify the inner signed claims!
Code Implementation Example
typescript
import { CompactSign, CompactEncrypt } from 'jose';
async function createNestedJwt(claims: object, issuerPrivateKey: crypto.KeyObject, recipientPublicKey: crypto.KeyObject) {
// 1. Sign inner JWS
const jws = await new CompactSign(new TextEncoder().encode(JSON.stringify(claims)))
.setProtectedHeader({ alg: 'RS256' })
.sign(issuerPrivateKey);
// 2. Encrypt outer JWE containing inner JWS
const jwe = await new CompactEncrypt(new TextEncoder().encode(jws))
.setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
.encrypt(recipientPublicKey);
return jwe; // Nested JWT!
}💡Constructing Nested JWT (JWS signed inside JWE encrypted wrapper) using jose library.
🎯 Interview Key Takeaway
Nested JWTs sign claims with JWS and encrypt the wrapper with JWE, guaranteeing both authenticity and strict confidentiality.
#Nested JWT#JWE#JWS#Encryption#Intermediate
Back to all Authentication & Authorization Questions→