Ravi Sir's Cards › AWS
Validate JWTs
This revision card explains Validate JWTs. It starts from the need that trusting a token without verifying signature/claims invites impersonation. It describes aPIs must verify issuer, audience, signature (JWKS), and expiry on Cognito access/ID tokens. The how-to section covers how to use API Gateway Cognito authorizer or verify in app middleware; never skip in “just for now”. An example on the card is expired token , then 401; wrong aud , then reject even if signature looks fine.
Read card text
What this card says
Why do we need it?
Trusting a token without verifying signature/claims invites impersonation.
What is it?
APIs must verify issuer, audience, signature (JWKS), and expiry on Cognito access/ID tokens.
JWT
How to do it
Use API Gateway Cognito authorizer or verify in app middleware; never skip in “just for now”.
Example
Expired token → 401; wrong aud → reject even if signature looks fine.