JSON Web Signature
JWS.
A standard (RFC 7515) for representing signed content as a compact, URL-safe JSON object, the dominant integrity mechanism for JWTs.
The classic JWT validation mistake, accepting a token without verifying the JWS signature, is documented in production CVEs at multiple vendors. Modern JWT libraries default to validating; verify your library does and pin the expected algorithm to prevent algorithm-substitution attacks.
Common questions
What's the difference between JWS and JWT?
Should I use RS256 or ES256?
Can I trust a JWT without verifying the signature?