Design stateless API security with OAuth2/JWT. What does the resource server validate, and what are the classic JWT mistakes?

# application.yml
spring.security.oauth2.resourceserver.jwt:
  issuer-uri: https://auth.acme.com/realms/acme   # discovers JWKS, validates iss

@Bean
JwtDecoder jwtDecoder(OAuth2ResourceServerProperties props) {
    var decoder = JwtDecoders.<NimbusJwtDecoder>fromIssuerLocation(
        props.getJwt().getIssuerUri());
    decoder.setJwtValidator(new DelegatingOAuth2TokenValidator<>(
        JwtValidators.createDefaultWithIssuer(issuer),
        new JwtClaimValidator<List<String>>("aud",                 // AUDIENCE ✅
            aud -> aud != null && aud.contains("orders-api"))));
    return decoder;
}

@Bean
JwtAuthenticationConverter authoritiesConverter() {      // claims -> authorities
    var granted = new JwtGrantedAuthoritiesConverter();
    granted.setAuthoritiesClaimName("roles");
    granted.setAuthorityPrefix("ROLE_");
    var conv = new JwtAuthenticationConverter();
    conv.setJwtGrantedAuthoritiesConverter(granted);
    return conv;
}