التحقق من الرموز في كل مكان

في هذا الدرس

make every service verify tokens itself.

الموضوعات المخطط لها

• The gateway is not enough: an attacker reaching a service directly bypasses it.
• Each service validates: signature (keys from the issuer's JWKS), issuer, audience, expiry, and scopes or roles.
• Audience matters: a token for inventory must not be accepted by payments.
• Never trust a header such as X-User-Id set by the gateway unless the network path guarantees it and the token is still verified.
• Keep tokens short-lived; cache JWKS with rotation support.