Different purposes need different rules
05Token kinds sharing an ecosystem must not be interchangeable.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.12 ↗
RFC 8725 · § 3.12EXAMPLE
3 / 3
03
Profile mismatch
Reject rather than treating any valid JWT as an authorization token.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Use explicit typing for new JWT applications when appropriate.
- Use explicit typing for new JWT applications when appropriate.
- Apply mutually exclusive validation rules to different JWT kinds.
- Separate required claims, keys, issuers, audiences, or types as appropriate.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy