A rowan-berry press API currently accepts any well-formed JWT. Which validation must the developer require for Microsoft Entra access tokens?
Select an answer to reveal the explanation.
Short Explanation
A JWT that merely looks tidy isn’t enough. The API has to insist the audience is this API and the issuer is the Entra endpoint you trust.
Full Explanation
Token validation for Entra-protected APIs includes verifying signature against signing keys, lifetime, issuer, and audience. Audience must identify the receiving API (application ID URI or client ID). Accepting arbitrary well-formed JWTs without these checks allows tokens meant for other resources to be replayed against the API.