Anyone can Base64URL-decode a JWT header and payload. Trust begins only after cryptographic signature and claim verification using expected configuration.
Decode the header and payload
Read alg, kid, iss, aud, exp, nbf, and application claims without treating them as authentic.
header.payload.signaturePin the expected algorithm
Never accept whichever algorithm the untrusted header requests. Configure an explicit allow-list.
Verify the signing key
Use the trusted shared secret or public key associated with the expected issuer and key ID.
Validate claims
Check issuer, audience, expiration, not-before, and application-specific authorization on the server.
Key takeaways
- Decoded claims are untrusted input.
- Pin algorithms and trusted issuers.
- Authorization must not rely on browser-side decoding.