A digital signature is cryptographic data attached to a token. It lets an API verify that a trusted party issued the token and that its contents have not been altered. In a JWT, the header contains metadata, the payload contains claims, and the signature proves legitimacy. section 7.8 section 1.4
Treat signature validation as a critical authentication check:
- Use strong signing algorithms and validate the signature on every token. section 1.4
- Reject unsigned tokens and tokens whose signatures do not validate; otherwise attackers can alter claims, hijack accounts, or escalate privileges. section 4.4
- Test token validation explicitly, including forged, unsigned, and expired tokens. section 4.4
Forged access token
An API accepts a JWT after checking its claims but fails to validate its signature. An attacker can modify those claims to impersonate another user or obtain higher privileges. Accepting an unsigned token creates the same kind of authentication failure. section 4.4
