Concept
A JWT carries claims signed by the issuer. A resource server verifies the signature against the issuer's published keys, checks the expiry, issuer and audience, and only then trusts the claims.
The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.
A few lines that show JWT validation doing its job.
// application.yml
// spring.security.oauth2.resourceserver.jwt.issuer-uri: https://auth.example.com/
@Bean
JwtDecoder jwtDecoder(OAuth2ResourceServerProperties props) {
var decoder = JwtDecoders.<NimbusJwtDecoder>fromIssuerLocation(props.getJwt().getIssuerUri());
var audience = new JwtClaimValidator<List<String>>("aud", aud -> aud != null && aud.contains("orders-api"));
decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
JwtValidators.createDefaultWithIssuer(props.getJwt().getIssuerUri()), audience));
return decoder;
}Decoding the token and reading its claims without verifying the signature, or accepting any token the issuer signed without checking the audience. Both let a token meant for another API through.
Your roadmap puts these before JWT validation, unless you already know them.
Once a session shows you understand JWT validation, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.