Mike Jones
- Co-author and editor of OAuth 2.0 (RFC 6749) supporting documents
- Lead author of JSON Web Token (RFC 7519) and related JOSE specifications
- Co-editor of OpenID Connect Core 1.0
Bio
Mike Jones is one of the most prolific contributors to modern identity standards. His name appears as author or editor on the JSON Web Token (RFC 7519), JSON Web Signature, JSON Web Encryption, and JSON Web Key specifications. Long career at Microsoft where he led identity standards work before becoming an independent consultant.
Notable contributions
Lead author or editor on the JOSE specification suite (JWT, JWS, JWE, JWK). Co-editor of OpenID Connect Core. Active contributor to OAuth working group specifications across two decades.
Profile built from public IETF and OpenID Foundation records. Corrections welcome.
Where their work shows up
The specifications carrying his name are the ones almost every modern identity system depends on: JWT (RFC 7519), JSON Web Signature, JSON Web Encryption, and JWKS. Those formats underpin OpenID Connect ID tokens and most access tokens, which is also why JWT validation errors are a recurring class in our identity CVE catalog.
Podcasts
- OpenID Connect with Mike Jones · Identity, Unlocked · 2021-12-20
Related on Start with Identity
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci