JWT Validation Process

JWT Validation Process A workflow diagram generated by Archify. 01 / Client 02 / Sidecar 03 / jwtRules validation EX / Outcome Client request · HTTP request · Client Client request HTTP request Authorization header? · Check for Bearer token · Sidecar · RequestAuthentication Authorization header? Check for Bearer token RequestAuthentication Extract & decode JWT · Header.Payload.Signature · Sidecar Extract & decode JWT Header.Payload.Signature Issuer check · iss field · jwtRules validation Issuer check iss field Audiences check · aud field · jwtRules validation Audiences check aud field Signature check · JWKS (jwksUri) · jwtRules validation Signature check JWKS (jwksUri) Expiration check · exp field · jwtRules validation Expiration check exp field No token · Skip validation · Outcome No token Skip validation Reject · 401 Unauthorized · Outcome Reject 401 Unauthorized Allow · Forward request · Outcome Allow Forward request Fail Pass Valid Expired Yes No Pass Fail Pass Fail Legend Sidecar processing step Validation decision Final outcome Client

JWT payload fields

  • • iss: token issuer
  • • aud: intended audiences
  • • exp: expiration time

RequestAuthentication jwtRules

  • • issuer: must match the iss field
  • • jwksUri: where the public keys for signature validation live
  • • audiences: must match the aud field