How can the authenticity and integrity of a JSON Web Token be verified?

To verify the authenticity and integrity of a JSON Web Token (JWT), it is necessary to validate the token's signature. A JWT consists of three parts: header, payload, and signature. The signature is created using a secret key (for HMAC) or a private key (for asymmetric algorithms like RSA).

To verify a JWT:

1. Split the token into three parts.
2. Check that the signature matches the header and payload, using a known secret key or public key.
3. Check the token's expiration time (the 'exp' field in the payload).
4. Verify other claims, such as issuer ('iss'), audience ('aud'), etc.

Example in Java using the jjwt library:

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureException;

public class JwtValidator {
    private static final String SECRET_KEY = "mySecretKey";

    public static boolean validateToken(String token) {
        try {
            Jwts.parser()
                .setSigningKey(SECRET_KEY.getBytes())
                .parseClaimsJws(token);
            return true; // signature is valid and token is not expired
        } catch (SignatureException e) {
            // signature does not match
            return false;
        } catch (Exception e) {
            // other errors (e.g., expired)
            return false;
        }
    }
}

Thus, signature verification guarantees the integrity and authenticity of the JWT.