No, if done correctly the site verifying the token should only need to verify it was signed by the authority token provider.
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No, if done correctly the site verifying the token should only need to verify it was signed by the authority token provider.