JWT Token-Claims Inactive User But Still Works

[justindallasverizon]

Hello Folks,

We have an app that uses a JWT token.  The payload is like this:

{
  "userId": "000InactiveUserId",
  "userDirectory": "MyDomain"
}

The user id references an inactive user, but the token still works.  What is going on?  Should access be denied? 

Any help is greatly appreciated.

[David_Friend]

@Sebastian_Linser / @Mike_Dickson / @Nick_Asilo any thoughts?

[David_Friend · Accepted solution]

As long as the user was active when the token was created then the token will continue to work.