Token validation everywhere
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
make every service verify tokens itself.
Planned topics
- The gateway is not enough: an attacker reaching a service directly bypasses it.
- Each service validates: signature (keys from the issuer's JWKS), issuer, audience, expiry, and scopes or roles.
- Audience matters: a token for
inventorymust not be accepted bypayments. - Never trust a header such as
X-User-Idset by the gateway unless the network path guarantees it and the token is still verified. - Keep tokens short-lived; cache JWKS with rotation support.
Draft outline details
Demonstration
spring.security.oauth2.resourceserver.jwt:
issuer-uri: https://auth.shop.example/realms/shopplus an audience validator.
Check your understanding
Why validate audience?
Show answer
A token meant for one service must not work on another.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.