Study. uk . com
  1. Home
  2. All questions
  3. Question 354

CISSP study material · question 354 of 500

A service receives a JSON web token whose audience claim names a different service. What does RFC 7519 require it to do?

  1. Accept it and forward it to the named audience.
  2. Reject the token, since a principal not identified in the audience claim must not process it.
  3. Accept it if the signature verifies, since the audience claim is advisory.
  4. Accept it if the issuer is trusted, since audience is checked only at issuance.
Show the answer

Answer: B. Reject the token, since a principal not identified in the audience claim must not process it.

Every principal meant to process the token must identify itself in the audience claim, and one that cannot must reject the token where the claim exists.

Source: RFC 7519 (IETF) — RFC 7519 > 4.1.3 aud (Audience) Claim

Challenge yourself on this topic → Study as cards