Passing client secret and verifying with it

[tej-rana]

I can't wrap my head around how this would work. The way I see this at the moment, you can simply decode the access token and use it again. That's because there isn't a secret key used in the server side. Unless the secret key defined for the app in Azure AD B2C tenant is used implicitly.

Ok so three things I've noticed with client secret.

1. The access token when decoded in https://jwt.io/ keeps saying invalid signature.

2. When requesting the access token, I think you can send client by adding an extra parameter like below. But that is simply plain text. Even it is coming from a mobile app, that can easily be seen.

&client_secret=<client secret>

3. In the portal you can set the secret key for the web api by adding an App Key. I'm not sure if this is used implicitly.

Can someone me understand this?

[gsacavdm]

The client secret is used redeem an access code for an access token, it has nothing to do with verifying the token. Tokens are verified by checking:

• The signature against the keys listed in the identity provider's metadata - for example this metadata URL links to jwks_uri
• Checking the audience to make sure the token was issued to your specific application
• Checking the authority to ensure the token by the party that you trust.

Implementing this yourself is not trivial, it's error prone and a lot is as stack if you make a mistake, which is why we recommend you use libraries (such as the .Net Owin middleware) that do this for you.

[gsacavdm]

As to why the access token shows as invalid signature in jwt.io, see this StackOverflow post: Azure AD B2C - Token validation does not work

[jmprieur]

Closing as this sample is being archived in favor of a better sample