Skip to content
AI Security

Interview question · Identity, OAuth & Access Control

What can go wrong when validating a JWT, and how do you validate one correctly?

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

mediumEssentialNewPreparation tags: Google, Amazon, MicrosoftUpdated Nov 2026

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

You are reviewing an API that accepts JWTs signed by your identity provider, and the code uses the token header to decide how to verify it.

  1. Why is trusting the header dangerous?
  2. How should the algorithm and keys be chosen?
  3. Which claims must be checked?
  4. What if the token contains a role claim?
  5. How would you test the API's validation?
  6. What would you require in the review?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackWhy do passkeys resist phishing when one-time codes do not?Next in this trackAn AI agent acts on behalf of a user. Whose identity does it use, which scopes, and how is access revoked?Next in this trackWhat is a confused deputy, and how does it show up in agents and OAuth proxies?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.