JWT validation, algorithm policy, and claim semantics

Mechanism

A JWT is an encoded claims object with a signature or MAC, not automatically an encrypted message. Signature verification must use a server-selected algorithm and trusted key. Even a valid signature does not establish that the issuer, audience, expiry, or token purpose is appropriate for the endpoint consuming it.

Practical method

Decode the header and payload without trusting either. Identify the accepted algorithm and the configured key source. Test malformed signatures separately from claim changes. Compare access and identity tokens and check issuer, audience, time constraints, and replay policy. If a key identifier selects a resource, inspect that resolution path as an independent input boundary.

verify signature with configured algorithm/key
verify iss and aud against endpoint policy
verify exp/nbf with a bounded clock allowance
verify token purpose and required scopes

Interpreting evidence

Successful decoding proves only that the token is syntactically readable. A useful lab experiment establishes which verification step is missing by changing exactly one property at a time. Record whether failure occurs before authorization or during application use.

Pitfalls and limits

Algorithm confusion requires a specific key-handling mistake and is not universal. A long token lifetime magnifies replay risk. Key rotation and stale caches can create inconsistent behavior across backends.