I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends them back in the form of an http only cookie. I wrote a route to provide token validation on the login backend so that if you send a token to /validate, it will validate the token and send back a boolean value.

I also wrote a separate app that requires a login. This app's backend (also written with express) gets the cookie from the login backend. Whenever the app backend makes a request, it should validate the token before sending any requests out. The question I have is: where should I validate the token and why? Should I validate the token using my login backend's validate route? Or should I grab the public key and validate the token on my app's own backend?

I read somewhere that it depends if you want to keep validation centralized or not.

  • Welcome to the community. It depends on the alg and usually you have a login microservices or IdP or similar these days specially for that purpose.. Commented Apr 23 at 18:01

1 Answer 1


Typically, you would verify the JWT on your app backend, without talking to the login server. You should verify the signature and several fields in the JWT, such as the expiration time. If you use a JWT library, it likely takes care of that.

This means of verification is the main use case of JWTs or other signed tokens. If you are going to talk to the login server anyway, it would be simpler to have an opaque token, i.e. a random string without meaning.

  • So if I were to do app backend verification, I would need to make the public key accessible by the app correct? Commented Apr 29 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .