Importancy of validate Issuer and audience in JWT, When app is the only token provider for itself

Question

Sounds like stupid question, But i cannot find/infer answer of following question from many articles.

1. Who is Issuer? (probably the token provider we trust. Like "Google, Faceboock, etc" and our site accepts tokens from theme).
2. Who is Audience?
3. Should i validate these two if i don't use OAuth and OpenID? I mean, Are they only used for 3rd-party authentication/authorization (because my site is the only issuer of my own tokens)?
4. What risk should i take if i don't validate these two, when my site don't use 3rd-parties to authenticate and authorize?

Nonbelligerent

Answer 1

1. yes, the issuer is the Provider of the token
2. the Client i.e. the recipient in OpenID Connect, the Resource Server in OAuth 2.0
3. if a JWT has an audience, the recipient should validate that it is the audience
4. someone uses a token that was issued for a different service/API (e.g. API B) against your service/API (e.g. API A)

Drugstore

The word "Client" is confusing in 2. It should be "Resource Server" which is the receiving party. Client may refer to the API client that is trying to use the token to access resources. – Gonzales

updated the answer to include OAuth vs. OIDC – Drugstore