Web Security · Senior · Question 46 of 75

Why should API access tokens have a specific audience (`aud`)?

1To make tokens shorter
✓Correct answer: So a token issued for one API can't be replayed against another API that trusts the same issuer
3To tell the browser where to store the token

Explanation

Each resource server should reject tokens whose audience isn't itself. Otherwise a low-trust service can reuse tokens on a high-trust one.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.