Six Standard Claims, Each Blocks One Gap
The signature only blocks tampering. Six standard claims each block a different attack path. Skip any one of them, and that gap opens.
Signature verification only answers “who signed this?” It does not prove that the token belongs to your service. It does not prove the token is still valid. Each claim adds one layer of defense against a different gap.
| Claim | Without it |
|---|---|
alg (pinned server-side) | Attacker switches to none or RS256→HS256 |
iss (issuer) | Tokens signed by another service with the same secret pass |
aud (audience) | Refresh token works as access token |
sub (subject) | Consumer must know the custom claim name |
exp (expiration) | Stolen token works forever |
jti (JWT ID) | Same token replayed with no detection |
From the audit: Before the audit, auth-service signed tokens without
issoraud. Consumers verified without an algorithm pin. After the fix, all six claims went into shared-contracts as a single validation layer.
“The signature is the foundation. Six claims are six walls. Skip one wall, and the wind comes through.”
References:
Related: back to the Seven Blind Spots Behind a JWT Audit overview · The iss Claim · Algorithm Confusion and the none Attack · Access and Refresh Token Rotation · Timing-Safe Comparison