joserfc 1.7

These rules cover joserfc 1.7 for JWT, JWS, JWE, and JWK operations in Python. When using Authlib for OAuth or OpenID Connect flows, also apply the Authlib prompt for its installed version.

Token verification and claims

• Treat jwt.decode() as the cryptographic step, then call JWTClaimsRegistry.validate(token.claims) before trusting the result. Decoding does not perform the application's issuer, audience, expiration, or authorization checks.
• Use JWTClaimsRegistry, not BaseClaimsRegistry, for JWT time and registered-claim validation. Declare iss, aud, and exp essential, configure the expected issuer and audience, and require the subject or token identifier when the application's token profile needs them.
• Validate that decoded claims are a JSON object with the profile's exact types before registry validation. Require single strings for iss, sub, jti, and nonce when present; allow an audience list only where the profile permits it, and require finite JSON numbers for time claims, excluding booleans.
• Keep allow_blank false for identity and authorization claims. A value or values constraint does not require a missing claim unless essential is also true; list matching accepts any matching member, so implement a separate all-required-permissions check when the operation needs several permissions.
• Keep a live trusted clock and a small explicit leeway. Do not reuse a fixed now value in production; checking that iat is not in the future does not impose a maximum token age, which the application must enforce separately.
• Check the