JWT Validation: Verifying Tokens for Authentication and Authorization

JWT Validation: Verifying Tokens for Authentication and Authorization A practical guide to JWT validation — the process of checking a JSON Web Token's signature, claims, and structure to confirm a request is genuinely authenticated and authorized — covering signature verification, standard claim checks, key rotation, validation in ASP.NET Core, and the mistakes that most commonly lead to broken or bypassed validation. Table of Contents Introduction Anatomy of a JWT Signing Algorithms What "Validation" Actually Checks Signature Verification and Key Rotation Standard Claim Validation Validating JWTs in ASP.NET Core Custom Validation Logic Token Revocation: JWT's Fundamental Limitation Validating JWTs Across Services Common Vulnerabilities Debugging Validation Failures Quick Reference Table Conclusion Introduction A JWT arriving in an Authorization: Bearer <token> header is just a string until it's actually validated — and validation is doing considerably more work than it might first appear. It's not just "does this look like a JWT" or even just "is the signature valid" — proper validation confirms the token was issued by a trusted party, intended for this specific API, still within its valid time window, and hasn't been tampered with in any way. Get any one of these checks wrong or skip it, and you can end up with an API that accepts tokens it absolutely shouldn't. builder . Services . AddAuthentication ( JwtBearerDefaults . AuthenticationScheme ) . AddJwtBearer ( options => { options . Authority = "https://login.microsoftonline.com/{tenant-id}/v2.0" ; options . Audience = "api://my-api" ; }); Those two lines look simple, but they configure a genuinely thorough validation pipeline underneath — this guide covers exactly what that pipeline actually checks, why each check matters, and where things commonly go wrong when validation is configured incorrectly or bypassed under pressure. 1. Anatomy of a JWT Three parts, dot-separated eyJhbGciOiJSUzI 1 NiIsInR 5 cCI 6 IkpXVC