JWT validation: signature, issuer, audience and JWKS

Why is a decoded token not yet trustworthy?

UnderstandStudy an examplePractise

Understand the concept

JWT is a data format; an access token need not use it. A signed JWT commonly has readable payload data, because a signature provides integrity rather than secrecy. JWE is a separate encryption form. Decoding sub or role is not validation and can mean trusting attacker-controlled text.

Validate signatures using trusted keys and allowed algorithms. Check issuer, audience, expiry and not-before with controlled clock tolerance. A token for another API must not be accepted. Verified claims still require permission policies for the requested operation. An ID token is not a substitute for an API access token.

JWKS enables key rotation. A kid selects a candidate key, but arbitrary key URLs from a token must not become trusted sources. Use configured issuer metadata, bounded refreshing and appropriate caching. Do not log raw tokens or implement cryptography from scratch; use maintained authentication handlers.

WHEN TO USE IT

When validating API tokens and diagnosing key rollover.

COMMON PITFALL

Assuming a readable JWT is valid or a signed JWT is encrypted.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

Decode ≠ verify

Reading the payload only decodes the format.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

The signature is valid, but aud names another API. Should it be accepted?

Show the solution and explanation

Worked solution

Reject: audience mismatch

No. A trusted issuer does not grant the same access to every target.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.