JWT

Validate JWTs for the Context That Will Use Them

A service receives a JSON Web Token, verifies its signature successfully, reads the user identifier, and accepts the request. That sounds reasonable, but one question is still unanswered: was this token issued for this service and this purpose? A valid signature proves something narrow. Under the expected cryptographic scheme and key, it shows that the protected token content has not been changed since it was signed by whoever controls that signing key. It does not by itself prove that your API is an intended recipient, that the token is still within its accepted lifetime, or that a token created for one workflow should be accepted by another.