Bind issuer and audience
04A valid signature must be tied to the expected issuer and intended recipient.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.8 ↗
RFC 8725 · § 3.8EXAMPLE
3 / 3
03
Wrong recipient
Reject a token addressed to a different service.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Bind cryptographic keys to the issuer being validated.
- Bind cryptographic keys to the issuer being validated.
- Validate the subject in the application’s context.
- Use and validate audience to stop a token crossing to an unintended recipient.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy