FrontendHaltSecurity·Advanced·Conceptual·1 min read
What does a token's audience (aud) claim protect against?
Short interview answer
It ensures a token issued for one API or service can't be replayed against a different service that also trusts the same issuer, since that service can check the token was actually intended for it.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.