# How (not) to sign a JSON object

DevFeed: [How (not) to sign a JSON object](<https://devfeed.tech/articles/how-not-to-sign-a-json-object-29172.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2019/07/24/how-not-to-sign-json/>)

Published: 2019-07-24T12:50:00Z

Content type: tutorial

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [JSON](<https://devfeed.tech/topics/json.md>), [API](<https://devfeed.tech/topics/api.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [ECDSA](<https://devfeed.tech/topics/ecdsa.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [ecdsa](<https://devfeed.tech/tags/ecdsa.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [json](<https://devfeed.tech/tags/json.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [sha256](<https://devfeed.tech/tags/sha256.md>), [signing](<https://devfeed.tech/tags/signing.md>)

## AI overview

The article explains how to authenticate JSON data in transit. It recommends HMAC-based symmetric signing for most cases, while noting that embedding a signature inside a JSON object creates parsing and interoperability challenges.

## Source excerpt

Last year we did a blog post on interservice auth. This post is mostly about authenticating consumers to an API. That's a related but subtly different problem: you can probably impose more requirements on your internal users than your customers. The idea is the same though: you're trying to differentiate between a legitimate user and an attacker, usually by getting the legitimate user to prove that they know a credential that the attacker doesn't.