...

Introduction

In order to prevent unauthorized access from outside by faking the JWT, as of version 2021 Autumn, its signature can be used for an additional validation of the caller's authorization. As of version 2022 Spring, the expiration date is validated as well. Thus, it is not possible to authenticate with a token anymore if its expiration date is exceeded. The validation is provided by the internal endpoint /authentication/jwt/verify of the AUTHENTICATION Service. In order to activate the validation, the endpoint has to be exposed manually.

...

If the signature of the JWT matches its header and payload, and the expiration date is not exceeded, the validation will be successful and the response body contains true. If the validation fails, the response body contains false.

...

...