Right Signature Wrong Ear

A gateway forwards this bearer token to the reporting service at https://reports.northwind.io/. The service verifies the HS256 signature with the shared key, confirms exp is in the future, and confirms iss matches its configured issuer. The clock reads 2026-08-17 07:30:00 UTC.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InByb2QtMjAyNi0wMyJ9.eyJpc3MiOiJodHRwczovL2F1dGgubm9ydGh3aW5kLmlvLyIsInN1YiI6InVzZXJfODQyMTMiLCJhdWQiOiJodHRwczovL2JpbGxpbmcubm9ydGh3aW5kLmlvLyIsImV4cCI6MTc4Njk1MzYwMCwiaWF0IjoxNzg2OTUwMDAwLCJzY29wZSI6Imludm9pY2VzOnJlYWQgaW52b2ljZXM6d3JpdGUiLCJ0ZW5hbnQiOiJhY21lIn0.1O_3P8volibBJ897EFzaTZ7Z6NwMjQ78hZIP1MIeu94

Decoded:

{ "alg": "HS256", "typ": "JWT", "kid": "prod-2026-03" }

{
  "iss": "https://auth.northwind.io/",
  "sub": "user_84213",
  "aud": "https://billing.northwind.io/",
  "exp": 1786953600,
  "iat": 1786950000,
  "scope": "invoices:read invoices:write",
  "tenant": "acme"
}

exp is 08:00:00 UTC and iat is 07:00:00 UTC. What should the reporting service do with this token?

Reject it, because HS256 means every service holding the shared key could have minted this token, so no HMAC-signed JWT is trustworthy across service boundaries.

Reject it. aud names the billing service, and a JWT must be rejected when the principal processing it does not identify itself with a value in aud.

Accept it. The signature verifies and there are 30 minutes left on exp, so the token is live and the scope claim decides what the caller may do.

Reject it, because typ is JWT rather than at+jwt, which marks this as an ID token being replayed as an access token.