JWT crit Header
The crit (critical) header parameter lists header names that must be understood and processed by the recipient. If a verifier sees a crit entry for a header it does not support, it must reject the token. This protects senders that rely on extension headers from silent ignorance by old verifiers. crit itself must not appear inside its own list. Most simple access-token deployments never set crit. When you introduce custom protected headers that change security semantics, declare them in crit so outdated services fail closed instead of accepting tokens incompletely. Always verify signatures before interpreting any critical header semantics in application code paths.
Why It Matters
Without crit, extension headers can be ignored by verifiers that do not implement them, creating split-brain security behavior across versions. With crit, rollouts become explicit: old nodes reject new tokens until upgraded. Use crit sparingly for true security-critical extensions, document required support, and test negative paths where unknown critical headers appear during canary deployments across your fleet. Reserve crit for headers that must not be ignored for security correctness, document required support before rollout, and canary tokens that exercise unknown-crit rejection paths so old nodes fail closed instead of silently skipping protections.
Related Terms
Related Tools
Related Articles
Frequently Asked Questions
Do I need crit for normal JWTs?
Rarely. Ordinary access tokens with standard claims do not need crit. Use it when introducing extension headers that must not be ignored for safe verification.
What if a verifier does not know a crit header?
It must reject the token. That fail-closed behavior is the point of crit and why rollouts need coordinated library upgrades before issuers set new critical names.
Can crit include alg or typ?
Profiles discourage listing headers that verifiers already must understand. Prefer crit for true extensions your libraries implement explicitly before issuers start setting those names.