JWT (JSON Web Token) authentication mode for APIs, and JWT API keys

[Martin]

Hi @ionutzp

What data have you got in your sub claim in the body of your JWT?

If Tyk can’t find the token ID in the header it will search for this field.

@ionutzp

I’ve noticed that behaviour with a regular access token as well. Is this a vulnerability in Tyk gateway?

Can you go into more detail on this?