Web Security · Middle · Question 41 of 75

What must a server check when it receives a JWT?

1Only that the sub claim matches the URL
✓Correct answer: The signature with the expected algorithm and key, plus exp, iss and aud
3Only that the token can be decoded

Explanation

Skipping any of these opens attacks: expired tokens still working, tokens for another service accepted, or forged signatures.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.