jperezduerto.info
Security in depth · Unit 19 · Lesson 6 of 8
A token needs an intended recipient
Use a simplified token-validation record to keep issuer trust, audience, and application permission separate.
Helpful before thisInitial access and credentials
After this lesson you can
- Explain why a valid signature and application role do not resolve an audience mismatch.
One idea. One situation. One reasoned decision.
How it works
A token’s audience identifies its intended recipient under the relevant protocol. Validation should check more than whether a token is well formed or has a recognized signature. Issuer, audience, lifetime, and application-specific permissions must fit the request. A token accepted by one service should not automatically be accepted by every other service that recognizes the same identity provider.
Read the supplied record
A fictional JWT access-token profile requires the receiving service to appear in the audience. The following is a readable validation record, not an encoded token:
| Check | Supplied result |
|---|---|
| Issuer and signature | Expected issuer; signature valid using an allowed algorithm |
| Lifetime | Within the accepted time window |
| Audience | Reports service only |
| Receiving service | Inventory service |
The subject also has an inventory-reader role. That role does not make Inventory an intended recipient. Under the stated profile, reject this token for the inventory request. This is a token-validation decision before the application evaluates a permitted action on a particular resource.
If a different token names Inventory, audience matching alone still does not finish validation. Issuer, cryptographic policy, lifetime, token type, and resource authorization remain relevant. Different protocols define their claims and checks; do not infer that every bearer credential is a JWT or that an ID token is automatically an API access token.
The key distinction: Identity-provider trust does not erase audience boundaries.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
How should the inventory service treat the supplied token record?
Show the answer
Correct answer: Reject it for this request because inventory is not an intended audience under the stated profile. Issuer trust and a valid signature do not satisfy the required recipient check.
Try it
- WriteWrite an acceptance decision for this record, naming the failed requirement and two other checks that would still matter for a token with the right audience.