Page Comparison

Signed JWTs (JWS) are crucial to the OpenID Connect specification in order to ensure the authenticity and integrity of data exchanged between parties.

...

When integrating BankID over OpenID Connect you must always validate Tokens that are issued. You should also strongly consider encrypting sensitive data using encrypted request objects.

Topics

Table of ContentsexcludeTopics

Validation of Signed Tokens

...

1. Extract the key information from the JWS Token header: kid, alg 
2. Retrieve all JWK entries that BankID exposes from the JWKs endpoint.
3. Keys used for signing can be filtered by the use attribute on each JWK. This value should be sig.
4. Find the key used to sign the JWS Token by matching the kid, alg from (1) with the JWK entries.
5. Extract the public key and certificate chain (x5c) from the JWK entry.
6. Validate the origin of the key by verifying it's complete certificate chain (x5c) with our published root certificate.
7. Validate the JWS token using the key.

...

...