.Net Core API JWT Token Validation

Question

Implemented the JWT Bearer Token validation in .Net Core WEB API as mentioned below:

 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(opt =>
                {
                    opt.Audience = Configuration["AAD:ResourceId"];
                    opt.Authority = $"{Configuration["AAD:Instance"]}{Configuration["AAD:TenantId"]}";
                });

Doubt here is the above mentioned code will validate only the audience and authority ? or it will validate all the parameters like expiration and signature etc. ?

Do we need to validate the signature explicitly to check the payload has been tampered ?

Answer 1

I think you're looking for this:

https://zhiliaxu.github.io/how-do-aspnet-core-services-validate-jwt-signature-signed-by-aad.html

Here zhiliaxu explains in details how and what is actually validated when using .AddJwtBearer() and their conclusions are:

Now it is clear that

• JWT signature is validated without providing any key or certification in our service’s source code.
• JWT signing key is retrieved from the well-known URL https://login.microsoftonline.com/common/discovery/keys, based on JwtBearerOptions.Authority property.
• The signing key is cached in the JwtBearerHandler singleton instance, and so our ASP.NET Core service only needs to retrieve it once throughout its lifecycle.

Also based on this article we can take a look at the ValidateToken() documentation on MSDN: https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.jwt.jwtsecuritytokenhandler.validatetoken?view=azure-dotnet Where you can find the different exceptions the method throws:

• SecurityTokenDecryptionFailedException: token was a JWE was not able to be decrypted.
• SecurityTokenEncryptionKeyNotFoundException: token 'kid' header claim is not null AND decryption fails.
• SecurityTokenException: token 'enc' header claim is null or empty.
• SecurityTokenExpiredException: token 'exp' claim is < DateTime.UtcNow.
• SecurityTokenInvalidAudienceException: token 'aud' claim did not match either ValidAudience or one of ValidAudiences.
• SecurityTokenInvalidLifetimeException: token 'nbf' claim is > 'exp' claim.
• SecurityTokenInvalidSignatureException: token.signature is not properly formatted.
• SecurityTokenNoExpirationException: TokenReplayCache is not null and expirationTime.HasValue is false. When a TokenReplayCache is set, tokens require an expiration time.
• SecurityTokenNotYetValidException: token 'nbf' claim is > DateTime.UtcNow.
• SecurityTokenReplayAddFailedException: token could not be added to the TokenReplayCache.
• SecurityTokenReplayDetectedException: token is found in the cache.