Intermediate LevelREST APIs & Web Services
What is JSON Web Encryption (JWE) and how does it encrypt sensitive payload data?
❓ Interview Prompt: Explain JSON Web Encryption (JWE), 5-part structure (`Header.EncryptedKey.IV.Ciphertext.Tag`), end-to-end payload confidentiality, and JWT vs JWE.
While standard JWTs (JWS) are signed but unencrypted (readable by anyone), JSON Web Encryption (JWE) (RFC 7516) encrypts the payload body completely:
5-Part JWE Structure:
'JOSE Header . Encrypted Key . Initialization Vector . Ciphertext . Authentication Tag'
Primary Use Case:
Transmitting highly sensitive PII (Social Security Numbers, Credit Cards) across untrusted intermediary proxies or message queues where transport TLS alone is insufficient.
Code Implementation Example
typescript
import * as jose from 'jose';
// Encrypt sensitive JSON payload using JWE
const secretKey = crypto.randomBytes(32);
const jweToken = await new jose.CompactEncrypt(
new TextEncoder().encode(JSON.stringify({ ssn: '999-00-1234' }))
)
.setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
.encrypt(secretKey);💡Encrypting sensitive payload data with JWE using JOSE library.
🎯 Interview Key Takeaway
Use JWE (JSON Web Encryption) when API payload data must remain strictly confidential end-to-end across untrusted transit hops.
#JWE#Encryption#Security#Intermediate
Back to all REST APIs & Web Services Questions→