Q3: What are the standard JWT Registered Claims and their definitions?
RFC 7519 defines a set of optional, standardized claim keys known as Registered Claims to ensure interoperability across applications:
iss(Issuer): Identifies the principal that issued the JWT.sub(Subject): Identifies the principal that is the subject of the JWT (e.g., User ID).aud(Audience): Identifies the recipients that the JWT is intended for.exp(Expiration Time): Identifies the expiration time on or after which the JWT MUST NOT be accepted.nbf(Not Before): Identifies the time before which the JWT MUST NOT be accepted.iat(Issued At): Identifies the time at which the JWT was issued.jti(JWT ID): Provides a unique identifier for the JWT (used to prevent replay attacks).
Key Takeaways
- Registered claims are standardized shorthand keys designed for interoperable security checks.
- Always enforce
expvalidation on backend resource servers to limit the exposure window of compromised tokens.