Validation is a chain of checks
05A token becomes usable only after parsing, cryptographic verification, and application checks succeed.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7.2 ↗
RFC 7519 · § 7.2EXAMPLE
4 / 4
04
Only then authorize an action.
Cryptographic validity alone does not establish permission.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 7519 § 7.2RFC 8725 § 3
The JWT BCP strengthens implementation guidance: allowlist algorithms, validate issuer and audience, and use distinct validation rules for different token kinds.
Read the updated RFC section ↗Reject at the first failed required check.
- Processing must reject a JWT if a required validation step fails.
- The application determines acceptable algorithms; support for an algorithm does not imply it must be accepted.
- Applications define required claims and the rules for their use.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy