How to ensure that the token received by the service is valid, unchanged, and not compromised?

To ensure that a token is valid, unaltered, and not compromised, you need to:

1. Verify the token's signature. Usually, tokens (e.g., JWT) are signed with a secret key or a private key. Signature verification guarantees that the token has not been altered.

2. Check the expiration date. Make sure the token has not expired.

3. Verify other fields (claims). For example, issuer (iss), audience (aud), etc., to ensure the token is intended for your service.

4. Use secure storage and transmission of keys. Keys used for signature verification should be stored securely and not be compromised.

Example of JWT validation in Go using the github.com/golang-jwt/jwt library:

import (
    "github.com/golang-jwt/jwt"
    "errors"
)

func ValidateToken(tokenString string, secret []byte) (*jwt.Token, error) {
    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
        // Check the signing algorithm
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, errors.New("unexpected signing method")
        }
        return secret, nil
    })

    if err != nil {
        return nil, err
    }

    if !token.Valid {
        return nil, errors.New("invalid token")
    }

    return token, nil
}

Thus, signature and validity checks are key steps to ensure security.