RFC 7519

JSON Web Token (JWT)
Standards Track
May 2015
RFC Library > OAuth & JOSE > RFC 7519
Abstract: JSON Web Token (JWT) is a compact, URL-safe format for representing claims between two parties. JWTs are used in 3GPP 5G as OAuth 2.0 access tokens issued by the NRF for NF service authorization.
Canonical source: https://www.rfc-editor.org/rfc/rfc7519  |  IETF Datatracker

1. Introduction

▶

A JWT is a compact claims representation format intended for space-constrained environments such as HTTP Authorization headers. JWTs consist of three Base64URL-encoded parts separated by dots: Header.Payload.Signature.

In 5G, JWTs are the format for access tokens issued by the NRF. The JWT payload contains claims identifying the consumer NF, target NF, allowed services, and token lifetime.

2. JWT Structure

▶

Each part is Base64URL encoded. The signature covers the header and payload, preventing tampering.

  eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJOUkYiLCJzdWIi...Ij0.MEUCIQCx...
\________  ________/ \____________  _____________/ \____  _____/
\/                       \/                     \/
JOSE Header            JWT Claims Set           JWS Signature
(algorithm)            (iss, sub, aud,          (ECDSA/RSA)
exp, scope, ...)

3. 5G Access Token Claims

▶
Claim Type 5G Usage
iss String NRF NF Instance ID (issuer)
sub String Consumer NF Instance ID
aud String/Array Target NF type or NF Instance ID
scope String Allowed NF services (e.g., namf-comm nsmf-pdusession)
exp NumericDate Token expiration time (Unix timestamp)
iat NumericDate Token issued-at time
jti String Unique token identifier (for revocation tracking)
consumerPlmnId Object Consumer's PLMN ID {mcc, mnc} — roaming scenarios
producerPlmnId Object Producer's PLMN ID {mcc, mnc} — roaming scenarios
producerSnssaiList Array Allowed S-NSSAIs for slice-specific authorization

4. JWT Processing

▶

The NF producer validates a received JWT access token as follows:

  • Base64URL decode header — determine algorithm (alg) and key ID (kid)
  • Retrieve NRF's public key using kid from JWKS endpoint or local cache
  • Verify JWS signature over header.payload using the public key
  • Decode payload and validate registered claims (exp, iss, aud)
  • Check scope claim includes the requested service operation
  • For roaming: validate producerPlmnId matches this NF's PLMN

5. Security Considerations

▶
  • MUST verify signature — never accept unsigned JWTs ('alg: none' attack)
  • MUST validate exp claim — reject expired tokens
  • MUST validate aud claim — prevent token misuse across NF types
  • Token claims are Base64URL encoded, NOT encrypted — sensitive data should not be in payload without JWE
  • NRF MUST use strong signing algorithms (ES256 or RS256 minimum)