advancedScenario Questions
Scenario 3: Two different microservices (Accounts and Loans) both trust the same Keycloak realm. How do you prevent a token meant for Accounts from being replayed against Loans?
Configure and validate the 'aud' (audience) claim on the JWT for each resource server — each service should reject tokens whose audience doesn't explicitly include itself. This typically requires configuring distinct audiences per client/scope in Keycloak and adding an audience validator on each resource server's JWT decoder.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response