# oauth-audience-restriction

Published articles for oauth-audience-restriction.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Why JWT Signature Verification Alone Can't Prevent Token Replay

DevFeed: [Why JWT Signature Verification Alone Can't Prevent Token Replay](<https://devfeed.tech/articles/why-jwt-signature-verification-alone-can-t-prevent-token-replay-118812.md>)

Original publisher: [Read original article](<https://hackernoon.com/why-jwt-signature-verification-alone-cant-prevent-token-replay?source=rss>)

Author: Sai Pavan Kumar Mandapaka

Published: 2026-11-05T07:05:57Z

Content type: article

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Secure token management](<https://devfeed.tech/topics/secure-token-management.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [access-tokens](<https://devfeed.tech/tags/access-tokens.md>), [api-authorization](<https://devfeed.tech/tags/api-authorization.md>), [api-security](<https://devfeed.tech/tags/api-security.md>), [cross-api-token-replay](<https://devfeed.tech/tags/cross-api-token-replay.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [jwt-audience-validation](<https://devfeed.tech/tags/jwt-audience-validation.md>), [jwt-security](<https://devfeed.tech/tags/jwt-security.md>), [jwt-signature-verification](<https://devfeed.tech/tags/jwt-signature-verification.md>), [oauth-2-0-security](<https://devfeed.tech/tags/oauth-2-0-security.md>), [oauth-access-tokens](<https://devfeed.tech/tags/oauth-access-tokens.md>), [oauth-audience-restriction](<https://devfeed.tech/tags/oauth-audience-restriction.md>)

### AI overview

Signature verification proves a JWT is authentic; it does not prove the token was issued for the API receiving it. In a hypothetical shared-issuer setup, an API that checks signature, issuer, and expiry but skips `aud` may accept a token intended for another service, though resulting access still depends on its other authorization checks. The document recommends each resource server enforce an expected audience, alongside issuer, signature, expiry, token type, scopes, and endpoint or object permissions. RFC 8707 supports requesting resource-specific tokens; RFC 9068 requires audience validation for its JWT access-token profile; RFC 9700 recommends limiting tokens to one resource server where feasible, or a small set. Sender-constrained methods such as mutual TLS or DPoP can further limit who can present a token. The example Python correction is explicitly not a complete RFC 9068 validator. The scenario is illustrative, not a confirmed product vulnerability or tested finding.

### Source excerpt

A valid JWT isn't always authorized. Discover how missing audience checks expose APIs to token replay and how to prevent it.