What JWT Tokens should be stored for use later?

Question

I am looking at implemented Cognito for user login and would like to understand the process of validating JWT's a little better.

The application in question is on asp.net 4.5 MVC and not related to .NET Core. The only information on AWS Cognito I can find online relates to .NET core.

I understand the meaning of each token type as documented here: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html#amazon-cognito-user-pools-using-the-id-token

I also understand the required steps in validating a JWT: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html

My question is which JWT needs to be validated and at what stage?

Example 1.
A user logs in, once logged in they are returned with an Access, ID and Refresh token.
Do all of the tokens need to be validated at this point or just the Access token?

Is the refresh token only validated before trying to use it (in order to gain new access and ID tokens)?
OR should all tokens be validated on any authorised content request?

What tokens should be stored in the FormsAuthentication Cookie for use later? We are using the standard [Authorize] pattern in asp.net.

Answer 1

Question: Do all of the tokens need to be validated at this point or just the Access token?

Answer: Validation is always done on Access token only.

Refresh token itself need not be validated. It is merely used for the purpose of obtaining fresh set of ID token and Access token.

Question: What tokens should be stored in the FormsAuthentication Cookie for use later?

Answer: This is specific to implementation. There is no rule on what token must be saved.

If the requirement is to just know the user's email or phone number, then just the ID token can be saved.

If the requirement is to allow one-time access for up an hour for the user, then storing just the access token is sufficient.

If the requirement is to allow user to access the resource for up to 30 days, without being prompted for password, then refresh token must be saved.