| OIDC / JWT | SAML / XML Token | |
|---|---|---|
| Format | Compact JSON, Base64url-encoded, 3 parts | Verbose XML document |
| Transport | HTTP header (Bearer), URL fragment, JSON body | Browser form POST (SAMLResponse) |
| Signing | JSON Web Signature (JWS) — RSA or ECDSA over a hash | XML Digital Signature — canonicalized XML subtree |
| Primary consumer | Modern APIs, SPAs, mobile apps | Legacy enterprise apps, portals |
| User Identifier | sub claim — opaque unique string for the user | saml:NameID element — format varies - email, persistent ID, transient |
| Claims | JSON key/value pairs inside a payload object | XML saml:Attribute elements inside an Assertion |
| Initiated by | SP redirects user to IdP with a simple URL | IdP POSTs XML blob to SP's ACS URL |
| Tooling | Lightweight — any JWT library in any language | Heavy — requires XML parsing, canonicalization, namespace handling |
| Size | ~500 bytes typical | ~2–10 KB typical |
Last active
July 23, 2026 02:21
-
-
Save rbrayb/5c542f45e18f0bd94f01295aa0f0df80 to your computer and use it in GitHub Desktop.
Difference between OIDC JWT and SAML XML
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment