API Gateway protects municipal APIs with JWTs issued after Cognito login. What must backends do on each call?
Select an answer to reveal the explanation.
Short Explanation
A JWT is a signed hall pass with an expiration time. Check the signature and claims every call; don’t treat a forever API key or an unsigned blob as “good enough” for resident auth.
Full Explanation
Bearer token security requires validating JWT signature and claims (iss, aud, exp, etc.) on each request, commonly via API Gateway JWT/Cognito authorizers or equivalent library checks. Non-empty headers, unsigned payloads, and immortal caches bypass auth guarantees; static API keys alone are a weak substitute for per-user Cognito tokens.