For JWT tokens, verify all of the following on every request:

• Signature — is this token actually signed by us?

• Algorithm — explicitly whitelist allowed algorithms (e.g. HS256, RS256). Reject anything else, including "none".

• Expiry (exp claim) — is this token still valid? Reject expired tokens.

• Issuer (iss claim) — did this come from our auth server?

• Audience (aud claim) — was this token intended for this service?

Use short-lived access tokens (minutes to hours) with refresh tokens. Revoke refresh tokens on logout or suspicious activity.

Imagine someone hands you a signed check. You wouldn't cash it without verifying: the signature is real, the date hasn't expired, the check is made out to you, and it's from a bank you recognize. JWT validation is the same checklist.

Proper token validation stops forgery but not theft. A validly-signed token stolen via XSS or log exposure will still pass all these checks. Combine with short expiry times and the other mitigations.