C validating data types
A JWT is a compact, URL-safe means of transferring information between two parties.
The information contained in JWTs are known as "claims", or assertions of information about the bearer and subject of the token.
The application that receives the token must verify that the audience value is correct and reject any tokens intended for a different audience.
Example SAML Value: Indicates how the subject was authenticated, as opposed to the client in the Application Authentication Context Class Reference claim.
The claims in JWTs are JSON objects encoded and serialized for transmission.
Since the JWTs issued by Azure AD are signed, but not encrypted, you can easily inspect the contents of a JWT for debugging purposes.
If a bearer token is transmitted in the clear, a man-in the middle attack can be used to acquire the token and gain unauthorized access to a protected resource.Id_tokens are a form of sign-in security token that your app receives when performing authentication using Open ID Connect.They are represented as JWTs, and contain claims that you can use for signing the user into your app.Azure Active Directory (Azure AD) emits several types of security tokens in the processing of each authentication flow.This document describes the format, security characteristics, and contents of each type of token.