The default behavior of the tool should be to validate JWT tokens that are signed with RSA. The initial implementation will not validate HSxxx (HMAC shared secret) tokens nor other public key signatures besides RSA. These can be supported later.
The validation procedure will adhere to the following rules:
- validate RSA signature using the key from the JWKS endpoint
- validate
iss, nbf, iat and exp claims
recommended guidelines
The default behavior of the tool should be to validate JWT tokens that are signed with RSA. The initial implementation will not validate HSxxx (HMAC shared secret) tokens nor other public key signatures besides RSA. These can be supported later.
The validation procedure will adhere to the following rules:
iss,nbf,iatandexpclaimsrecommended guidelines