Security vulnerability for JWT authentication: Evaluate JWT attributes 'aud', 'jti' and 'iss'

JWT Attributes are not being evaluated when JWT authentication is used in Qlik Sense February 2019. This is an issue because further securing the JWT by limiting down the access and usage is not possible using the attributes such as "aud", "jti" or "iss".

Qlik Sense does not check the intended purpose / audience of JWT tokens and not even if the JWT attribute ‘aud’ is specified, how do we ensure any intended use? Documentation mentions the JWT attributes: 'iss', 'sub', 'aud'.

The Qlik Code checks that they contain a valid value, but it does not take any action on them. There is no way to limit the audience with 'iss', 'sub', 'aud'.