Google paper's author compares Macaroons and JWTs
As a consumer/verifier of macaroons, they allow you (through third-party caveats) to defer some authorization decisions to someone else. JWTs don't.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
Biscuit clever-cloud.com
Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like…
-
Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud web.archive.org
Google's original paper.
-
Google's Macaroons in Five Minutes or Less web.archive.org
If I'm given a Macaroon that authorizes me to perform some action(s) under certain restrictions, I can non-interactively build a second Macaroon with stricter restrictions that I can then give to you.
-
API Security in Action manning.com
Book covering API security including secure development, token-based authentication, JSON Web Tokens, OAuth 2, and Macaroons. (early access, published continuously, final release summer 2020)
-
JWT, JWS and JWE for Not So Dummies! web.archive.org
A signed JWT is known as a JWS (JSON Web Signature). In fact a JWT does not exist itself — either it has to be a JWS or a JWE (JSON Web Encryption). Its like an abstract class — the JWS and JWE are the concrete implementations.
-
OAuth 2.0 JWT-Secured Authorization Request (JAR) datatracker.ietf.org
Allows to send request parameters in a JSON Web Token (JWT), which can be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication, and confidentiality properties of the authorization request are attained.
IAM › Authorization > Macaroons: “As a consumer/verifier of macaroons, they allow you (through third-party caveats) to defer some authorization decisions to someone else. JWTs don't.”