7 / 8 Authentication: Sessions, JWT & OAuth

Before You Trust the Claims

You are writing the JWT validation middleware for a resource server that accepts tokens from your authorization server. Which checks belong in it?

A

Require iss to name an issuer you trust and aud to name this service, so a token minted for another audience is rejected

B

Keep a server side copy of every token you issue and compare the incoming string against that record byte for byte before accepting the request

C

Accept only the algorithms your policy allows, so a token whose header says none, or one signed with HMAC against your RSA public key, is rejected

D

Compare exp and nbf against the current clock, allowing only a small tolerance for skew between issuer and verifier

E

Treat the payload as trustworthy once base64url decoding succeeds, on the basis that any alteration in transit corrupts the encoding and fails the decode