Validating tokens correctly
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
list every check a server must make on a token.
Planned topics
- Verify the signature with the expected key and the expected algorithm; never trust the token's own
alg, and rejectalg: none. - Check
issequals your issuer andaudincludes your API. - Check
exp(andnbfif used), allowing only a tiny clock skew. - Use a well-tested library (Spring's resource server uses Nimbus); never hand-write validation.
- Keep signing keys secret (shared secret) or the private key private (asymmetric).
Draft outline details
Demonstration
a checklist: signature, algorithm, issuer, audience, expiry, then roles.
Check your understanding
Why reject alg: none?
Show answer
It means "unsigned", so anyone could forge a token.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.