How does the Backend verify JWT token forgery?

The backend verifies the authenticity of a JWT token using the following methods:

1. Signature verification — the server uses a secret key (for HMAC) or a public key (for RSA/ECDSA) to verify the digital signature of the token. If the signature does not match, the token is forged.

2. Expiration check (exp) — the server checks whether the token has expired.

3. Verification of other standard fields (claims) — for example, issuer (iss), audience (aud), to ensure the token was issued by a trusted source and is intended for this service.

Example of JWT verification in Python with the PyJWT library:

import jwt
from jwt import InvalidTokenError

SECRET_KEY = 'your-secret-key'

def verify_jwt(token):
    try:
        payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'], options={"verify_exp": True})
        # Additional checks for payload['iss'], payload['aud'] if necessary
        return payload
    except InvalidTokenError:
        return None

If decode is successful, the token is considered authentic and not forged.