التحقق من الرموز بشكل صحيح

في هذا الدرس

list every check a server must make on a token.

الموضوعات المخطط لها

• Verify the signature with the expected key and the expected algorithm; never trust the token's own alg, and reject alg: none.
• Check iss equals your issuer and aud includes your API.
• Check exp (and nbf if used), allowing only a tiny clock skew.
• Use a well-tested library (Spring's resource server uses Nimbus); never hand-write validation.
• Keep signing keys secret (shared secret) or the private key private (asymmetric).