Study. uk . com
  1. Home
  2. All questions
  3. Question 358

CISSP study material · question 358 of 500

A team assumes a JSON web token is malformed because it carries no expiry claim. What does RFC 7519 say about the registered claims?

  1. They are all optional, including issuer, subject, audience and expiry.
  2. Registered claims are mandatory only in unsecured tokens.
  3. All registered claims are mandatory in tokens carrying a signature.
  4. Expiry and issuer are mandatory; the rest are optional.
Show the answer

Answer: A. They are all optional, including issuer, subject, audience and expiry.

RFC 7519 marks each registered claim - issuer, subject, audience, expiration time, not before, issued at and token identifier - as optional; nothing in the format compels their use.

Source: RFC 7519 (IETF) — RFC 7519 > 4.1 Registered Claim Names

Challenge yourself on this topic → Study as cards