L9 · IDENTITY FUNDAMENTALS
Reading is not validating
Decode a token from your test tenant, then submit it unchanged and tampered to a verifier.
Planned
Steps
Get a token from your test tenant and decode it with the tenant's Token Decoder.
What the server will check: Nothing to check. Anyone holding the token can read it.
Submit the unchanged token to the lab verifier.
What the server will check: The verifier accepted it.
Change one claim and submit it again.
What the server will check: The verifier rejected it because the signature no longer matches.
Decoding shows what a token claims. Only validation shows whether to believe it.
When it opens
This lab is planned. It opens when these are in place:
- Lab setup and cleanup in your test tenant
- A lab token verifier
The server checks your test tenant's history for this attempt. You can review the events yourself in your tenant's Audit and Logs.