Validate a JavaScript Object Notation (JSON) Web Token (JWT) before trusting its claims.
A JavaScript Object Notation (JSON) Web Token (JWT) is a signed claims format. A JSON Web Key Set (JWKS) publishes public keys an issuer can use for signature verification.
Why this lesson?
An Orders application programming interface (API) receives a signed token after the issuer changes its signing key. The API must find a trusted current verification key before it can accept the token.
Learning goal and prerequisites
Receive a JWT access token
The application programming interface (API) receives a JavaScript Object Notation (JSON) Web Token (JWT) access token. Before using any claim, it checks which issuer is expected and reads the token header to determine which allowed verification key and algorithm should be considered.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
A JavaScript Object Notation (JSON) Web Token (JWT) can carry claims in a compact signed form, but readable claims are not automatically trustworthy. Anyone can copy or alter the text of a token. The receiving application must validate the token before using its contents for identity or authorization.
Validation begins with the signature. The application uses the issuer’s trusted public key, often obtained from a JavaScript Object Notation Web Key Set (JWKS), to verify that the token was signed by the expected authority and has not been changed. The application also checks the allowed signing algorithm instead of trusting an algorithm chosen by the token.
Signature validation is only one part of the decision. The application should verify the issuer, intended audience, expiration, not-before time when present, and any other claims required by its protocol or policy. A correctly signed token can still be wrong for this API or outside its valid lifetime.
Key rotation is another reason to use a trusted key set. Issuers can publish new verification keys before retiring old ones. The receiver should refresh keys safely when needed, while still treating the issuer configuration—not the token itself—as the source of trust.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.