验证JWT签名后，是否仍需校验其Payload字段？

Great question—this is a common point of confusion, even when you're the one issuing the JWTs. The short answer is: Absolutely, you still need to validate the payload fields, including checking things like whether userid is an integer.

Let me break down why this matters, even with a trusted JWT implementation:

1. Signature verification only guarantees integrity, not validity #

A valid signature tells you the payload hasn't been tampered with since you signed it. But it doesn't guarantee:

• That the fields were set correctly in the first place (e.g., a bug in your issuing logic might have accidentally set userid to a string instead of an integer)
• That the fields align with your current business rules (e.g., if you later update your system to require userid to be a positive integer, old JWTs with invalid values might still be in circulation)

2. Type mismatches can break your system #

Take your example: if userid is sent as a string "123456789" instead of the integer 123456789, the signature will still be valid (since the payload wasn't altered). But if your backend code expects an integer, this could lead to type errors, failed database queries, or unexpected behavior that's hard to debug.

3. You need to enforce business and security constraints #

Beyond type checks, you should validate:

• Standard claims: Always verify exp (expiration time) to ensure the JWT isn't expired, iss (issuer) to confirm it came from your service (especially if you have multiple environments like staging/production), and nbf (not before) if you use it.
• Custom claims: Check that userid corresponds to an actual, active user in your system; ensure company is a value your system recognizes; and validate any other custom fields against your business rules.

Example of payload validation steps for your sample #

For the payload { "iss": "example.com", "exp": 1426420800, "company": "example", "userid": 123456789, "name": "Bob" }, you should:

• Confirm iss exactly matches your expected issuer (e.g., "example.com" for production)
• Check that exp is a valid timestamp and that the current time is before this timestamp
• Verify userid is a non-negative integer and exists in your user database
• Ensure company is one of the allowed values in your system

In short: Signature verification is the first line of defense, but it's not sufficient on its own. Validating payload fields protects your system from accidental errors and ensures compliance with your business requirements.

内容的提问来源于stack exchange，提问作者craft