This library implements the JavaScript Object Signing and Encryption (JOSE) family of specifications for Go: JSON Web Signature (RFC 7515), JSON Web Encryption (RFC 7516), JSON Web Key (RFC 7517), the JSON Web Algorithms (RFC 7518) and JSON Web Token (RFC 7519). It is maintained by the Authelia team.
It is a fork of go-jose which holds itself closely to the specifications and to the guidance which accompanies them, such as the JSON Web Token Best Current Practices (RFC 8725). It aims to accept anything it produces, and to refuse anything a specification does not permit, both when parsing and when producing a token or key. This makes it stricter than many other implementations, so it may reject input which they accept.
Forked from go-jose at commit 8d4e64d.
This library officially supports the latest minor version of Go only, which is currently Go 1.27. Earlier versions are not supported, and features such as ML-DSA are only available with Go 1.27 or later. These rules apply at the time of a published release.
This library is intended to be used with Go Toolchains as indicated by the toolchain
directive in the go.mod.
This library handles a critical element of security in a dependent project, so where backwards compatibility and security are at odds we will choose security. We consider this especially reasonable in Go, where upgrading the toolchain is rarely a breaking change.
| Feature | JWS | JWE | Specification |
|---|---|---|---|
| Compact Serialization | ✅ | ✅ | RFC 7515, RFC 7516 |
| JSON Serialization (General and Flattened) | ✅ | ✅ | RFC 7515, RFC 7516 |
| Multiple Signatures / Recipients | ✅ | ✅ | RFC 7515, RFC 7516 |
| Detached Payload | ✅ | - | RFC 7515 Appendix F |
Unencoded Payload (b64) |
✅ | - | RFC 7797 |
Additional Authenticated Data (aad) |
- | ✅ | RFC 7516 |
Compression (zip: DEF) |
- | ✅ | RFC 7516, RFC 7518 |
Critical Header Parameters (crit) |
✅ | ✅ | RFC 7515, RFC 7516 |
| Critical Extensions Supported | b64 |
None | RFC 7515, RFC 7516 |
| Algorithm | Supported | Specification | Notes |
|---|---|---|---|
HS256, HS384, HS512 |
✅ | RFC 7518 | Key at least as long as the hash output |
RS256, RS384, RS512 |
✅ | RFC 7518 | RSA modulus of at least 2048 bits |
PS256, PS384, PS512 |
✅ | RFC 7518 | RSA modulus of at least 2048 bits |
ES256, ES384, ES512 |
✅ | RFC 7518 | P-256, P-384 and P-521 respectively |
EdDSA |
✅ | RFC 8037, RFC 9864 | Ed25519 only; deprecated, supported for compatibility |
Ed25519 |
✅ | RFC 9864 | Fully specified; preferred for new integrations |
ML-DSA-44, ML-DSA-65, ML-DSA-87 |
✅ | RFC 9964 | Requires Go 1.27 |
ES256K |
❌ | RFC 8812 | |
Ed448 |
❌ | RFC 8037, RFC 9864 | |
none |
❌ | RFC 7518 | Unsecured JWS is not supported by design |
| Algorithm | Supported | Specification | Notes |
|---|---|---|---|
RSA1_5 |
✅ | RFC 7518 | RSA modulus of at least 2048 bits |
RSA-OAEP, RSA-OAEP-256 |
✅ | RFC 7518 | RSA modulus of at least 2048 bits |
A128KW, A192KW, A256KW |
✅ | RFC 7518 | |
A128GCMKW, A192GCMKW, A256GCMKW |
✅ | RFC 7518 | |
dir |
✅ | RFC 7518 | Single recipient only |
ECDH-ES |
✅ | RFC 7518 | P-256, P-384 and P-521; single recipient only |
ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW |
✅ | RFC 7518 | P-256, P-384 and P-521 |
PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW |
✅ | RFC 7518 | p2c of 1,000 to 1,000,000 |
RSA-OAEP-384, RSA-OAEP-512 |
❌ | ||
ECDH-ES with X25519 or X448 |
❌ | RFC 8037 |
| Algorithm | Supported | Specification |
|---|---|---|
A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 |
✅ | RFC 7518 |
A128GCM, A192GCM, A256GCM |
✅ | RFC 7518 |
| Feature | Supported | Specification | Notes |
|---|---|---|---|
RSA keys |
✅ | RFC 7518 | Two prime keys only |
EC keys |
✅ | RFC 7518 | P-256, P-384 and P-521 |
OKP keys |
✅ | RFC 8037 | Ed25519 only |
oct keys |
✅ | RFC 7518 | |
AKP keys |
✅ | RFC 9964 | ML-DSA; requires Go 1.27 |
| JWK Sets | ✅ | RFC 7517 | |
use, key_ops and alg enforcement |
✅ | RFC 7517 | |
Certificate chains (x5c, x5t, x5t#S256, x5u) |
✅ | RFC 7517 | x5u is not dereferenced |
| Thumbprints | ✅ | RFC 7638 | Not computed for oct keys |
| Opaque and hardware backed keys | ✅ | See the cryptosigner package |
| Feature | Supported | Specification |
|---|---|---|
| Signed tokens | ✅ | RFC 7519 |
| Encrypted tokens | ✅ | RFC 7519 |
| Nested (signed then encrypted) tokens | ✅ | RFC 7519 |
Registered claim validation (iss, sub, aud, exp, nbf, iat, jti) |
✅ | RFC 7519 |
The gopher mascot is inspired by the Go gopher, designed by Renée French and licensed under the Creative Commons 4.0 Attribution License.