The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario?

I am looking at the example custom login from Auth0 here: https://github.com/auth0-samples/auth0-aspnet-owin-mvc-samples/blob/master/Samples/custom-login/MvcApplication/MvcApplication/Controllers/AccountController.cs

I see the token is received and the claim information parsed into cookie but it is never validated, is this correct?

  • 1
    Gosh that's some bad code. Regardless, are you sure that the validation isn't automatically happening somewhere in the invocation of the third-party library? Jan 29, 2020 at 13:17
  • No i am not sure
    – StuartM
    Jan 30, 2020 at 15:38

1 Answer 1


I have found the library that is used in this sample code here: https://github.com/auth0/auth0.net/blob/master/src/Auth0.AuthenticationApi/AuthenticationApiClient.cs

The sample is using the Resource Owner Password Credenatials flow (which is rather not recommended) but that is not the topic of the question. You can see in the related library that at the response the Identity Token is validated with an AssertIdTokenValid() function which is using IdTokenValidator:

private Task AssertIdTokenValid(string idToken, string audience, JwtSignatureAlgorithm algorithm, string clientSecret)
        var requirements = new IdTokenRequirements(algorithm, BaseUri.AbsoluteUri, audience, idTokenValidationLeeway);
        return idTokenValidator.Assert(requirements, idToken, clientSecret);

So by default the library is validating the Identity token.

The Access Token does not have to be validated in client application (Relying Party). It is only used by this client to authorize against API that the access token will be sent to - like it is when the UserInfo is requested to get the user claims. It is APIs responsibility to validate that access token.

DISCLAIMER: It is recommended to use Authorization Code flow with PKCE in such scenarios.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.