Zero Trust: JWT Access & Token Expiry
Zero Trust replaces "inside the perimeter is trusted" with "verify every request." This lab runs a real identity service, a protected application and a datastore, so you watch explicit verification, least privilege and short-lived tokens behave the way a Zero Trust architecture actually enforces them, not the way a slide describes them.
The problem
A user logs in, gets a token and reaches the protected API fine. A few minutes later, without logging out, every protected call starts returning 401, and a service-to-service request that worked at login now fails too.
What you'll practice
- Authenticate explicitly against the identity service and obtain a JWT
- Separate public from protected endpoints (least privilege)
- Inspect JWT claims (exp, iat, iss, aud) and validate them
- Handle short-lived tokens with a refresh before expiry
- Diagnose 401s caused by token expiry or clock skew (assume breach)
The topology
An identity service issues JWTs, a web application validates them on every protected request, and a datastore holds users and audit logs. Public endpoints need no token; protected ones verify explicitly, so the trust boundary sits at each hop rather than only at login.
Topology diagram
Frequently asked
Is this Cisco-specific?
The principles (verify explicitly, least privilege, assume breach) are the same ones Cisco's Zero Trust and ISE-based access enforce. Here you exercise them hands-on against a real token flow.
Are the tokens really short-lived?
Yes. Tokens expire in minutes by design, so you see fail-closed behaviour and refresh handling for real, not in theory.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.