Skip to content
All writing Part 03 of 07 · Seven Blind Spots Behind a JWT Audit
Engineering · 2 min read

Six Standard Claims, Each Blocks One Gap

The signature only blocks tampering. Six standard claims each block a different attack path. Skip any one of them, and that gap opens.

Signature verification only answers “who signed this?” It does not prove that the token belongs to your service. It does not prove the token is still valid. Each claim adds one layer of defense against a different gap.

Signature not tampered alg pin right algorithm iss right signer aud right recipient sub right identity exp still valid jti not replayed skip one layer → that gap opens
ClaimWithout it
alg (pinned server-side)Attacker switches to none or RS256→HS256
iss (issuer)Tokens signed by another service with the same secret pass
aud (audience)Refresh token works as access token
sub (subject)Consumer must know the custom claim name
exp (expiration)Stolen token works forever
jti (JWT ID)Same token replayed with no detection

From the audit: Before the audit, auth-service signed tokens without iss or aud. Consumers verified without an algorithm pin. After the fix, all six claims went into shared-contracts as a single validation layer.

“The signature is the foundation. Six claims are six walls. Skip one wall, and the wind comes through.”


References:

Related: back to the Seven Blind Spots Behind a JWT Audit overview · The iss Claim · Algorithm Confusion and the none Attack · Access and Refresh Token Rotation · Timing-Safe Comparison

Tags #jwt #security #authentication
// connect

Be brave | Be wise | Be grateful

21 BreakinCode

// elsewhere
LinkedInMedium (lang: en)Life RecordYoutube
wh:~$William Hung· © 2026 Taipei · GMT+8 · Available for collaboration