Q3: What are the standard JWT Registered Claims and their definitions?

Difficulty:EasyTopic:JWT Claims

RFC 7519 defines a set of optional, standardized claim keys known as Registered Claims to ensure interoperability across applications:

  • iss (Issuer): Identifies the principal that issued the JWT.
  • sub (Subject): Identifies the principal that is the subject of the JWT (e.g., User ID).
  • aud (Audience): Identifies the recipients that the JWT is intended for.
  • exp (Expiration Time): Identifies the expiration time on or after which the JWT MUST NOT be accepted.
  • nbf (Not Before): Identifies the time before which the JWT MUST NOT be accepted.
  • iat (Issued At): Identifies the time at which the JWT was issued.
  • jti (JWT ID): Provides a unique identifier for the JWT (used to prevent replay attacks).
Key Takeaways
  • Registered claims are standardized shorthand keys designed for interoperable security checks.
  • Always enforce exp validation on backend resource servers to limit the exposure window of compromised tokens.