API Design · Senior · Question 32 of 75

Why should JWT access tokens for APIs be validated strictly?

1Only the expiry matters
✓Correct answer: Check signature with an expected algorithm, issuer, audience and expiry; otherwise tokens for another service or forged tokens may be accepted
3Decoding the payload is enough

Explanation

Audience checks stop a token issued for service A being replayed against service B.

Further reading

Test yourself

Take the API Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.