What I Got Wrong About JWT Validation
Context I recently realized that my understanding of how JWTs are validated was incorrect. I thought the flow worked like this: The client presents its credentials to Entra ID and gets a JWT for a specific aud (audience). The client then presents that JWT to the resource — an API, for example. The API, after receiving the token, presents it back to Entra ID for validation: essentially asking, “Is this token actually valid and untampered?” Upon successful validation by Entra ID, the API would then check the claims and, if they check out, allow the client to access the API. ...