Verifying signature of JWT issued by Azure AD

[nominds]

Does ADAL.JS has functionality to validate signature of the token issued by Azure AD using the public key ( referring to jwks_uri ). If yes, then how do I achieve same using ADAL.JS. I have written a SPA and if I try to hit jwks_uri endpoint I receive CORS issue.

[jasonnutter]

@nominds No, it does not. Tokens should only be validated by their intended audience (i.e. the resource defined in teh aud claim). Our passport-azure-ad library can be used to do that: https://www.npmjs.com/package/passport-azure-ad

[nominds]

Thanks @jasonnutter for quick response.

aud claim is nothing but a client_id, right ? I remember seeing adal.js checks if client_id matches the aud claim then only it proceeds. Library even validates other claims. But I did not find code where it validates signature to ensure if the token is not tampered.

Do you know if MSAL supports validating token's signature using the public key ?

[jasonnutter]

@nominds No, ADAL.js and MSAL.js do not perform signature validation, as the signature should be verified by the resource the token is intended for (e.g. Microsoft Graph, custom web API).

[nominds]

So the web API consuming the token should connect to jwks_uri to validate the token signature.