A backend receives Cognito JWTs from a SPA and must verify them locally without calling Cognito on every request. What's the correct verification approach?
A.Decode the JWT and trust the claims
Decoding ≠ verifying — anyone can forge claims.
B.Verify the signature against the user pool's JWKS public keys, then check issuer, audience, and expiry claims
Correct. JWKS signature + claim validation is the documented pattern.
C.Call Cognito's GetUser API for every request
Works but adds a network call and rate limits per request — unnecessary for signature verification.
D.Verify only the expiry timestamp
Expiry alone doesn't prove the token is genuine.
Why this answer
JWTs are verified locally: download the pool's JWKS (public keys), verify the signature, then validate iss, aud/client_id, token_use, and exp claims. Skipping signature verification or trusting decoded claims is the classic vulnerability.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security