Should two JWTs still be considered equal if their claims/headers are in different orders?

Question

If I have two JWTs, where their set of claims and headers are the same but the order they are stored in json is different, should they be considered equal?

Clarification:

I am aware that as a user of JWTs you should not need to compare them, but that is not what I am doing.

Say we have some jwt library, and you have some object that represents a JWT in it's decoded form. If we create an encoded JWT from our decoded JWT and then apply it to some function that returns once again the decoded JWT. Do we consider the two decoded JWTs to be equal if the order in which the claims or headers are stored in some collection has changed due to the decoding process?

Thinking more about this, perhaps it is wrong to store the headers and claims in a collection which has some notion of order? Using something like a set makes this problem disappear?

Answer 1

Depends on what you mean by 'different'. If the claims are the same then they are the same in the sense that the information transferred is equal. But if they both have the same signature then at least one will be invalid.

Also you shouldn't need to compare JWT claims at all. If you're storing the token and comparing the token given then you should revisit why you're using JWT over something like session.

JWT is designed to be independent. Because JWT tokens are claims based authentication the validation is done against the signature, not against anything on the server.