Enforcing MuleSoft JWT Validation Policy Using API Manager API

Introduction

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between the two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted.

• JWTs are stateless, making tokens easier to manage.
• JWTs can be used to transfer claims securely between parties.
• JWTs are scalable.
• JWTs are decoupled in nature allowing authentication to happen on a different server.
  The tokens are compact. JSON format makes the token less verbose than XML. The smaller size allows easier transmission over HTTP.
• JWTs are JSON-based and can be easily parsed by multiple receiving systems, especially mobiles. This enables industry-wide adoption.

The JWT Validation policy validates the signature of the token and asserts the values of the claims of all incoming requests by using a JWT with JWS format. The policy does not validate JWT that uses JWE.