A developer uses JSON Web Tokens and stores the role claim ('role': 'admin') in the payload. An attacker modifies the payload and changes the role to 'admin'. The server uses asymmetric RS256 signing. Will this attack succeed?

• A.Yes - RS256 signs with the public key and verifies with the private key, and the attacker can obtain the public key from the JWKS endpoint; the modified payload is then re-signed with that key and the server accepts the forged role claim from the token
• B.Yes - the payload is base64url encoded and carries no signature in RS256 mode, and the server reads the role claim directly; the signature segment is used by the client for display, with no check on the server side of the gateway or of the application behind it
• C.No - RS256 encrypts the payload with the private key, and the attacker lacks it; the changed role claim fails decryption on the server, returning a 401 response to the browser
• D.No - with RS256, the signature is created using the private key. Modifying the payload invalidates the signature. The server verifies the signature using the public key; a modified payload will produce a signature mismatch and the JWT will be rejected