Trust comes from outside the token
06A self-described issuer or key is not enough to establish that a claim should be believed.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 11.1 ↗
RFC 7519 · § 11.1EXAMPLE
4 / 4
04
Use only validated claims.
Authorization still belongs to the application, not to the token format.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Bind the key, issuer, and application purpose.
- Trust in a claim depends on who made it and how it was protected.
- An unsecured JWT has alg none and an empty signature; only explicitly allowed contexts can use it.
- Avoid confusing tokens with different purposes, even if they share an issuer or signing key.
The final purpose check incorporates the later JWT BCP: RFC 8725 §§ 3.11–3.12 describe explicit typing and mutually exclusive validation rules.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy