Node.js › Authentication & Authorization (JWT, OAuth, Passport)

How do you validate a JWT's claims (issuer, audience, expiration) beyond just verifying its cryptographic signature?

Intermediate

Answer

Verifying a JWT's signature alone only confirms it hasn't been tampered with and was signed by the expected key -- a complete verification also needs to check the 'exp' claim (has it expired?), the 'iss' claim (was it issued by the expected authorization server?), and the 'aud' claim (was this token actually intended for this specific API, not a different one?), since a validly signed token intended for a different audience could otherwise be replayed against an API it was never meant to authenticate against.

const decoded = jwt.verify(token, publicKey, {
  issuer: 'https://auth.example.com',
  audience: 'my-api',
  algorithms: ['RS256'], // explicitly restrict allowed algorithms too
});
// jwt.verify() throws automatically if any of these claims don't match

Real-world example A company running multiple internal APIs discovers that a JWT issued for their billing API could technically also be replayed successfully against their user-profile API, since neither service was checking the 'aud' claim; adding strict audience validation to every API closes this cross-service token replay vulnerability.

Common follow-ups: Why is explicitly restricting the 'algorithms' option important, given the notorious 'alg: none' JWT vulnerability?;How do issuer and audience validation together prevent a token issued for one system from being accepted by an unrelated one?

Security;Microservices Architecture with Node.js