< draft-ietf-oauth-json-web-token-19.txt		draft-ietf-oauth-json-web-token-20.txt >
	OAuth Working Group M. Jones		OAuth Working Group M. Jones
	Internet-Draft Microsoft		Internet-Draft Microsoft
	Intended status: Standards Track J. Bradley		Intended status: Standards Track J. Bradley
	Expires: September 19, 2014 Ping Identity		Expires: November 1, 2014 Ping Identity
	N. Sakimura		N. Sakimura
	NRI		NRI
	March 18, 2014		April 30, 2014
	JSON Web Token (JWT)		JSON Web Token (JWT)
	draft-ietf-oauth-json-web-token-19		draft-ietf-oauth-json-web-token-20
	Abstract		Abstract
	JSON Web Token (JWT) is a compact URL-safe means of representing		JSON Web Token (JWT) is a compact URL-safe means of representing
	claims to be transferred between two parties. The claims in a JWT		claims to be transferred between two parties. The claims in a JWT
	are encoded as a JavaScript Object Notation (JSON) object that is		are encoded as a JavaScript Object Notation (JSON) object that is
	used as the payload of a JSON Web Signature (JWS) structure or as the		used as the payload of a JSON Web Signature (JWS) structure or as the
	plaintext of a JSON Web Encryption (JWE) structure, enabling the		plaintext of a JSON Web Encryption (JWE) structure, enabling the
	claims to be digitally signed or MACed and/or encrypted.		claims to be digitally signed or MACed and/or encrypted.
	skipping to change at page 1, line 41 ¶		skipping to change at page 1, line 41 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on September 19, 2014.		This Internet-Draft will expire on November 1, 2014.
	Copyright Notice		Copyright Notice
	Copyright (c) 2014 IETF Trust and the persons identified as the		Copyright (c) 2014 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 21 ¶		skipping to change at page 2, line 21 ¶
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
	1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4		1.1. Notational Conventions . . . . . . . . . . . . . . . . . . 4
	2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4		2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
	3. JSON Web Token (JWT) Overview . . . . . . . . . . . . . . . . 6		3. JSON Web Token (JWT) Overview . . . . . . . . . . . . . . . . 6
	3.1. Example JWT . . . . . . . . . . . . . . . . . . . . . . . 6		3.1. Example JWT . . . . . . . . . . . . . . . . . . . . . . . 6
	4. JWT Claims . . . . . . . . . . . . . . . . . . . . . . . . . . 8		4. JWT Claims . . . . . . . . . . . . . . . . . . . . . . . . . . 8
	4.1. Registered Claim Names . . . . . . . . . . . . . . . . . . 8		4.1. Registered Claim Names . . . . . . . . . . . . . . . . . . 8
	4.1.1. "iss" (Issuer) Claim . . . . . . . . . . . . . . . . . 8		4.1.1. "iss" (Issuer) Claim . . . . . . . . . . . . . . . . . 9
	4.1.2. "sub" (Subject) Claim . . . . . . . . . . . . . . . . 9		4.1.2. "sub" (Subject) Claim . . . . . . . . . . . . . . . . 9
	4.1.3. "aud" (Audience) Claim . . . . . . . . . . . . . . . . 9		4.1.3. "aud" (Audience) Claim . . . . . . . . . . . . . . . . 9
	4.1.4. "exp" (Expiration Time) Claim . . . . . . . . . . . . 9		4.1.4. "exp" (Expiration Time) Claim . . . . . . . . . . . . 9
	4.1.5. "nbf" (Not Before) Claim . . . . . . . . . . . . . . . 9		4.1.5. "nbf" (Not Before) Claim . . . . . . . . . . . . . . . 9
	4.1.6. "iat" (Issued At) Claim . . . . . . . . . . . . . . . 9		4.1.6. "iat" (Issued At) Claim . . . . . . . . . . . . . . . 10
	4.1.7. "jti" (JWT ID) Claim . . . . . . . . . . . . . . . . . 10		4.1.7. "jti" (JWT ID) Claim . . . . . . . . . . . . . . . . . 10
	4.2. Public Claim Names . . . . . . . . . . . . . . . . . . . . 10		4.2. Public Claim Names . . . . . . . . . . . . . . . . . . . . 10
	4.3. Private Claim Names . . . . . . . . . . . . . . . . . . . 10		4.3. Private Claim Names . . . . . . . . . . . . . . . . . . . 10
	5. JWT Header . . . . . . . . . . . . . . . . . . . . . . . . . . 10		5. JWT Header . . . . . . . . . . . . . . . . . . . . . . . . . . 10
	5.1. "typ" (Type) Header Parameter . . . . . . . . . . . . . . 11		5.1. "typ" (Type) Header Parameter . . . . . . . . . . . . . . 11
	5.2. "cty" (Content Type) Header Parameter . . . . . . . . . . 11		5.2. "cty" (Content Type) Header Parameter . . . . . . . . . . 11
	5.3. Replicating Claims as Header Parameters . . . . . . . . . 11		5.3. Replicating Claims as Header Parameters . . . . . . . . . 11
	6. Plaintext JWTs . . . . . . . . . . . . . . . . . . . . . . . . 12		6. Plaintext JWTs . . . . . . . . . . . . . . . . . . . . . . . . 12
	6.1. Example Plaintext JWT . . . . . . . . . . . . . . . . . . 12		6.1. Example Plaintext JWT . . . . . . . . . . . . . . . . . . 12
	7. Rules for Creating and Validating a JWT . . . . . . . . . . . 13		7. Rules for Creating and Validating a JWT . . . . . . . . . . . 13
	7.1. String Comparison Rules . . . . . . . . . . . . . . . . . 14		7.1. String Comparison Rules . . . . . . . . . . . . . . . . . 15
	8. Implementation Requirements . . . . . . . . . . . . . . . . . 15		8. Implementation Requirements . . . . . . . . . . . . . . . . . 15
	9. URI for Declaring that Content is a JWT . . . . . . . . . . . 15		9. URI for Declaring that Content is a JWT . . . . . . . . . . . 16
	10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16		10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
	10.1. JSON Web Token Claims Registry . . . . . . . . . . . . . . 16		10.1. JSON Web Token Claims Registry . . . . . . . . . . . . . . 16
	10.1.1. Registration Template . . . . . . . . . . . . . . . . 17		10.1.1. Registration Template . . . . . . . . . . . . . . . . 17
	10.1.2. Initial Registry Contents . . . . . . . . . . . . . . 17		10.1.2. Initial Registry Contents . . . . . . . . . . . . . . 17
	10.2. Sub-Namespace Registration of		10.2. Sub-Namespace Registration of
	urn:ietf:params:oauth:token-type:jwt . . . . . . . . . . . 18		urn:ietf:params:oauth:token-type:jwt . . . . . . . . . . . 18
	10.2.1. Registry Contents . . . . . . . . . . . . . . . . . . 18		10.2.1. Registry Contents . . . . . . . . . . . . . . . . . . 18
	10.3. Media Type Registration . . . . . . . . . . . . . . . . . 18		10.3. Media Type Registration . . . . . . . . . . . . . . . . . 18
	10.3.1. Registry Contents . . . . . . . . . . . . . . . . . . 18		10.3.1. Registry Contents . . . . . . . . . . . . . . . . . . 18
	10.4. Registration of JWE Header Parameter Names . . . . . . . . 19		10.4. Registration of JWE Header Parameter Names . . . . . . . . 19
	10.4.1. Registry Contents . . . . . . . . . . . . . . . . . . 19		10.4.1. Registry Contents . . . . . . . . . . . . . . . . . . 19
	11. Security Considerations . . . . . . . . . . . . . . . . . . . 19		11. Security Considerations . . . . . . . . . . . . . . . . . . . 20
	12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 20		12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 21
	12.1. Normative References . . . . . . . . . . . . . . . . . . . 20		12.1. Normative References . . . . . . . . . . . . . . . . . . . 21
	12.2. Informative References . . . . . . . . . . . . . . . . . . 21		12.2. Informative References . . . . . . . . . . . . . . . . . . 21
	Appendix A. JWT Examples . . . . . . . . . . . . . . . . . . . . 22		Appendix A. JWT Examples . . . . . . . . . . . . . . . . . . . . 22
	A.1. Example Encrypted JWT . . . . . . . . . . . . . . . . . . 22		A.1. Example Encrypted JWT . . . . . . . . . . . . . . . . . . 23
	A.2. Example Nested JWT . . . . . . . . . . . . . . . . . . . . 23		A.2. Example Nested JWT . . . . . . . . . . . . . . . . . . . . 23
	Appendix B. Relationship of JWTs to SAML Assertions . . . . . . . 25		Appendix B. Relationship of JWTs to SAML Assertions . . . . . . . 25
	Appendix C. Relationship of JWTs to Simple Web Tokens (SWTs) . . 26		Appendix C. Relationship of JWTs to Simple Web Tokens (SWTs) . . 26
	Appendix D. Acknowledgements . . . . . . . . . . . . . . . . . . 26		Appendix D. Acknowledgements . . . . . . . . . . . . . . . . . . 26
	Appendix E. Document History . . . . . . . . . . . . . . . . . . 26		Appendix E. Document History . . . . . . . . . . . . . . . . . . 26
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 31		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 31
	1. Introduction		1. Introduction
	JSON Web Token (JWT) is a compact claims representation format		JSON Web Token (JWT) is a compact claims representation format
	skipping to change at page 7, line 8 ¶		skipping to change at page 7, line 8 ¶
	3.1. Example JWT		3.1. Example JWT
	The following example JWT Header declares that the encoded object is		The following example JWT Header declares that the encoded object is
	a JSON Web Token (JWT) and the JWT is a JWS that is MACed using the		a JSON Web Token (JWT) and the JWT is a JWS that is MACed using the
	HMAC SHA-256 algorithm:		HMAC SHA-256 algorithm:
	{"typ":"JWT",		{"typ":"JWT",
	"alg":"HS256"}		"alg":"HS256"}
	The following octet sequence is the UTF-8 representation of the JWT		To remove potential ambiguities in the representation of the JSON
	Header/JWS Header above:		object above, the octet sequence for the actual UTF-8 representation
			used in this example for the JWT Header/JWS Header above is also
			included below. (Note that ambiguities can arise due to differing
			platform representations of line breaks (CRLF versus LF), differing
			spacing at the beginning and ends of lines, whether the last line has
			a terminating line break or not, and other causes. In the
			representation used in this example, the first line has no leading or
			trailing spaces, a CRLF line break (13, 10) occurs between the first
			and second lines, the second line has one leading space (32) and no
			trailing spaces, and the last line does not have a terminating line
			break.) The octets representing the UTF-8 representation of the JWS
			Header in this example (using JSON array notation) are:
	[123, 34, 116, 121, 112, 34, 58, 34, 74, 87, 84, 34, 44, 13, 10, 32,		[123, 34, 116, 121, 112, 34, 58, 34, 74, 87, 84, 34, 44, 13, 10, 32,
	34, 97, 108, 103, 34, 58, 34, 72, 83, 50, 53, 54, 34, 125]		34, 97, 108, 103, 34, 58, 34, 72, 83, 50, 53, 54, 34, 125]
	Base64url encoding the octets of the UTF-8 representation of the JWT		Base64url encoding the octets of the UTF-8 representation of the JWT
	Header yields this Encoded JWT Header value (which is also the		Header yields this Encoded JWT Header value (which is also the
	underlying encoded JWS Header value):		underlying encoded JWS Header value):
	eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9		eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9
	The following is an example of a JWT Claims Set:		The following is an example of a JWT Claims Set:
	{"iss":"joe",		{"iss":"joe",
	"exp":1300819380,		"exp":1300819380,
	"http://example.com/is_root":true}		"http://example.com/is_root":true}
	The following octet sequence, which is the UTF-8 representation of		The following octet sequence, which is the UTF-8 representation used
	the JWT Claims Set above, is the JWS Payload:		in this example for the JWT Claims Set above, is the JWS Payload:
	[123, 34, 105, 115, 115, 34, 58, 34, 106, 111, 101, 34, 44, 13, 10,		[123, 34, 105, 115, 115, 34, 58, 34, 106, 111, 101, 34, 44, 13, 10,
	32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, 56, 49, 57, 51, 56,		32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, 56, 49, 57, 51, 56,
	48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, 47, 47, 101, 120, 97,		48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, 47, 47, 101, 120, 97,
	109, 112, 108, 101, 46, 99, 111, 109, 47, 105, 115, 95, 114, 111,		109, 112, 108, 101, 46, 99, 111, 109, 47, 105, 115, 95, 114, 111,
	111, 116, 34, 58, 116, 114, 117, 101, 125]		111, 116, 34, 58, 116, 114, 117, 101, 125]
	Base64url encoding the JWS Payload yields this encoded JWS Payload		Base64url encoding the JWS Payload yields this encoded JWS Payload
	(with line breaks for display purposes only):		(with line breaks for display purposes only):
	skipping to change at page 20, line 38 ¶		skipping to change at page 21, line 4 ¶
	specification.		specification.
	The contents of a JWT cannot be relied upon in a trust decision		The contents of a JWT cannot be relied upon in a trust decision
	unless its contents have been cryptographically secured and bound to		unless its contents have been cryptographically secured and bound to
	the context necessary for the trust decision. In particular, the		the context necessary for the trust decision. In particular, the
	key(s) used to sign and/or encrypt the JWT will typically need to		key(s) used to sign and/or encrypt the JWT will typically need to
	verifiably be under the control of the party identified as the issuer		verifiably be under the control of the party identified as the issuer
	of the JWT.		of the JWT.
	12. References		12. References
	12.1. Normative References		12.1. Normative References
	[ECMAScript]		[ECMAScript]
	Ecma International, "ECMAScript Language Specification,		Ecma International, "ECMAScript Language Specification,
	5.1 Edition", ECMA 262, June 2011.		5.1 Edition", ECMA 262, June 2011.
	[IANA.MediaTypes]		[IANA.MediaTypes]
	Internet Assigned Numbers Authority (IANA), "MIME Media		Internet Assigned Numbers Authority (IANA), "MIME Media
	Types", 2005.		Types", 2005.
	[JWA] Jones, M., "JSON Web Algorithms (JWA)",		[JWA] Jones, M., "JSON Web Algorithms (JWA)",
	draft-ietf-jose-json-web-algorithms (work in progress),		draft-ietf-jose-json-web-algorithms (work in progress),
	March 2014.		April 2014.
	[JWE] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",		[JWE] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)",
	draft-ietf-jose-json-web-encryption (work in progress),		draft-ietf-jose-json-web-encryption (work in progress),
	March 2014.		April 2014.
	[JWK] Jones, M., "JSON Web Key (JWK)",
	draft-ietf-jose-json-web-key (work in progress),
	March 2014.
	[JWS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web		[JWS] Jones, M., Bradley, J., and N. Sakimura, "JSON Web
	Signature (JWS)", draft-ietf-jose-json-web-signature (work		Signature (JWS)", draft-ietf-jose-json-web-signature (work
	in progress), March 2014.		in progress), April 2014.
	[RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail		[RFC2046] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
	Extensions (MIME) Part Two: Media Types", RFC 2046,		Extensions (MIME) Part Two: Media Types", RFC 2046,
	November 1996.		November 1996.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997.		Requirement Levels", BCP 14, RFC 2119, March 1997.
	[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform		[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
	Resource Identifier (URI): Generic Syntax", STD 66,		Resource Identifier (URI): Generic Syntax", STD 66,
	RFC 3986, January 2005.		RFC 3986, January 2005.
	[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data		[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data
	Encodings", RFC 4648, October 2006.		Encodings", RFC 4648, October 2006.
			[RFC6755] Campbell, B. and H. Tschofenig, "An IETF URN Sub-Namespace
			for OAuth", RFC 6755, October 2012.
	[RFC7159] Bray, T., "The JavaScript Object Notation (JSON) Data		[RFC7159] Bray, T., "The JavaScript Object Notation (JSON) Data
	Interchange Format", RFC 7159, March 2014.		Interchange Format", RFC 7159, March 2014.
	12.2. Informative References		12.2. Informative References
	[CanvasApp]		[CanvasApp]
	Facebook, "Canvas Applications", 2010.		Facebook, "Canvas Applications", 2010.
	[JSS] Bradley, J. and N. Sakimura (editor), "JSON Simple Sign",		[JSS] Bradley, J. and N. Sakimura (editor), "JSON Simple Sign",
	September 2010.		September 2010.
			[JWK] Jones, M., "JSON Web Key (JWK)",
			draft-ietf-jose-json-web-key (work in progress),
			April 2014.
	[MagicSignatures]		[MagicSignatures]
	Panzer (editor), J., Laurie, B., and D. Balfanz, "Magic		Panzer (editor), J., Laurie, B., and D. Balfanz, "Magic
	Signatures", January 2011.		Signatures", January 2011.
	[OASIS.saml-core-2.0-os]		[OASIS.saml-core-2.0-os]
	Cantor, S., Kemp, J., Philpott, R., and E. Maler,		Cantor, S., Kemp, J., Philpott, R., and E. Maler,
	"Assertions and Protocol for the OASIS Security Assertion		"Assertions and Protocol for the OASIS Security Assertion
	Markup Language (SAML) V2.0", OASIS Standard saml-core-		Markup Language (SAML) V2.0", OASIS Standard saml-core-
	2.0-os, March 2005.		2.0-os, March 2005.
	skipping to change at page 22, line 20 ¶		skipping to change at page 22, line 35 ¶
	Internet: Timestamps", RFC 3339, July 2002.		Internet: Timestamps", RFC 3339, July 2002.
	[RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally		[RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally
	Unique IDentifier (UUID) URN Namespace", RFC 4122,		Unique IDentifier (UUID) URN Namespace", RFC 4122,
	July 2005.		July 2005.
	[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an		[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
	IANA Considerations Section in RFCs", BCP 26, RFC 5226,		IANA Considerations Section in RFCs", BCP 26, RFC 5226,
	May 2008.		May 2008.
	[RFC6755] Campbell, B. and H. Tschofenig, "An IETF URN Sub-Namespace
	for OAuth", RFC 6755, October 2012.
	[SWT] Hardt, D. and Y. Goland, "Simple Web Token (SWT)",		[SWT] Hardt, D. and Y. Goland, "Simple Web Token (SWT)",
	Version 0.9.5.1, November 2009.		Version 0.9.5.1, November 2009.
	[W3C.CR-xml11-20021015]		[W3C.CR-xml11-20021015]
	Cowan, J., "Extensible Markup Language (XML) 1.1", W3C		Cowan, J., "Extensible Markup Language (XML) 1.1", W3C
	CR CR-xml11-20021015, October 2002.		CR CR-xml11-20021015, October 2002.
	[W3C.REC-xml-c14n-20010315]		[W3C.REC-xml-c14n-20010315]
	Boyer, J., "Canonical XML Version 1.0", World Wide Web		Boyer, J., "Canonical XML Version 1.0", World Wide Web
	Consortium Recommendation REC-xml-c14n-20010315,		Consortium Recommendation REC-xml-c14n-20010315,
	skipping to change at page 24, line 18 ¶		skipping to change at page 24, line 30 ¶
	Header yields this encoded JWE Header value:		Header yields this encoded JWE Header value:
	eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiY3R5IjoiSldUIn0		eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiY3R5IjoiSldUIn0
	The computation of this JWT is identical to the computation of the		The computation of this JWT is identical to the computation of the
	JWE in Appendix A.2 of [JWE], other than that different JWE Header,		JWE in Appendix A.2 of [JWE], other than that different JWE Header,
	Plaintext, Initialization Vector, and Content Encryption Key values		Plaintext, Initialization Vector, and Content Encryption Key values
	are used. (The RSA key used is the same.)		are used. (The RSA key used is the same.)
	The Payload used is the octets of the ASCII representation of the JWT		The Payload used is the octets of the ASCII representation of the JWT
	at the end of Appendix Section A.2.1 of [JWS] (with all whitespace		at the end of Appendix A.2.1 of [JWS] (with all whitespace and line
	and line breaks removed), which is a sequence of 458 octets.		breaks removed), which is a sequence of 458 octets.
	The Initialization Vector value used is:		The Initialization Vector value used (using JSON array notation) is:
	[82, 101, 100, 109, 111, 110, 100, 32, 87, 65, 32, 57, 56, 48, 53,		[82, 101, 100, 109, 111, 110, 100, 32, 87, 65, 32, 57, 56, 48, 53,
	50]		50]
	This example uses the Content Encryption Key represented in JSON Web		This example uses the Content Encryption Key represented in JSON Web
	Key [JWK] format below:		Key [JWK] format below:
	{"kty":"oct",		{"kty":"oct",
	"k":"GawgguFyGrWKav7AX4VKUg"		"k":"GawgguFyGrWKav7AX4VKUg"
	}		}
	skipping to change at page 26, line 41 ¶		skipping to change at page 26, line 41 ¶
	the following individuals contributed ideas, feedback, and wording		the following individuals contributed ideas, feedback, and wording
	that influenced this specification:		that influenced this specification:
	Dirk Balfanz, Richard Barnes, Brian Campbell, Breno de Medeiros, Dick		Dirk Balfanz, Richard Barnes, Brian Campbell, Breno de Medeiros, Dick
	Hardt, Joe Hildebrand, Jeff Hodges, Edmund Jay, Yaron Y. Goland, Ben		Hardt, Joe Hildebrand, Jeff Hodges, Edmund Jay, Yaron Y. Goland, Ben
	Laurie, James Manger, Prateek Mishra, Tony Nadalin, Axel Nennker,		Laurie, James Manger, Prateek Mishra, Tony Nadalin, Axel Nennker,
	John Panzer, Emmanuel Raviart, David Recordon, Eric Rescorla, Jim		John Panzer, Emmanuel Raviart, David Recordon, Eric Rescorla, Jim
	Schaad, Paul Tarjan, Hannes Tschofenig, and Sean Turner.		Schaad, Paul Tarjan, Hannes Tschofenig, and Sean Turner.
	Hannes Tschofenig and Derek Atkins chaired the OAuth working group		Hannes Tschofenig and Derek Atkins chaired the OAuth working group
	and Sean Turner and Stephen Farrell served as Security area directors		and Sean Turner, Stephen Farrell, and Kathleen Moriarty served as
	during the creation of this specification.		Security area directors during the creation of this specification.
	Appendix E. Document History		Appendix E. Document History
	[[ to be removed by the RFC Editor before publication as an RFC ]]		[[ to be removed by the RFC Editor before publication as an RFC ]]
			-20
			o Changed the RFC 6755 reference to be normative.
			o Changed the JWK reference to be informative.
			o Described potential sources of ambiguity in representing the JSON
			objects used in the examples. The octets of the actual UTF-8
			representations of the JSON objects used in the examples are
			included to remove these ambiguities.
			o Noted that octet sequences are depicted using JSON array notation.
	-19		-19
	o Specified that support for Nested JWTs is optional and that		o Specified that support for Nested JWTs is optional and that
	applications using this specification can impose additional		applications using this specification can impose additional
	requirements upon implementations that they use.		requirements upon implementations that they use.
	o Updated the JSON reference to RFC 7159.		o Updated the JSON reference to RFC 7159.
	-18		-18
	o Clarified that the base64url encoding includes no line breaks,		o Clarified that the base64url encoding includes no line breaks,
	white space, or other additional characters.		white space, or other additional characters.
End of changes. 24 change blocks.
	32 lines changed or deleted		55 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/