# JWT.io **URL:** https://community.auth0.com/c/jwt/8.md?page=2 [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) **Page:** 3 --- ## [How to ensure that the JWT token has not been tempered with?](https://community.auth0.com/t/how-to-ensure-that-the-jwt-token-has-not-been-tempered-with/121286)
**Author:** [@mianhassani.uk](https://community.auth0.com/u/mianhassani.uk)\ **Replies:** 3\ **Last updated:** [November 22, 2023, 12:50am UTC](https://community.auth0.com/t/how-to-ensure-that-the-jwt-token-has-not-been-tempered-with/121286 "2023-11-22T00:50:18Z")
I had a question regarding how to ensure that the token that you have received as part of your api has the right and valid token? My front end is react and when the user logs in they receive a token from auth0 which is… --- ## [Authentication not working on ios v 17, has anyone encounter this issue? it is recent](https://community.auth0.com/t/authentication-not-working-on-ios-v-17-has-anyone-encounter-this-issue-it-is-recent/119878)
**Author:** [@toluxy100](https://community.auth0.com/u/toluxy100)\ **Replies:** 1\ **Last updated:** [November 6, 2023, 5:08pm UTC](https://community.auth0.com/t/authentication-not-working-on-ios-v-17-has-anyone-encounter-this-issue-it-is-recent/119878 "2023-11-06T17:08:42Z")
Auth0 integration works on every other version of ios , except for version 17. --- ## [Issue with express-oauth2-jwt-bearer](https://community.auth0.com/t/issue-with-express-oauth2-jwt-bearer/119104)
**Author:** [@ryanloh29](https://community.auth0.com/u/ryanloh29)\ **Replies:** 1\ **Last updated:** [October 27, 2023, 3:10pm UTC](https://community.auth0.com/t/issue-with-express-oauth2-jwt-bearer/119104 "2023-10-27T15:10:59Z")
I followed the tutorial at Auth0 Node (Express) API SDK Quickstarts: Authorization and created the middleware const checkJwt = auth({ audience: process.env.AUDIENCE\_ID, issuerBaseURL: process.env.ISSUER\_BASE\_URL, }… --- ## [References JWT versions over years](https://community.auth0.com/t/references-jwt-versions-over-years/118770)
**Author:** [@ganeshsurfs](https://community.auth0.com/u/ganeshsurfs)\ **Replies:** 1\ **Last updated:** [October 23, 2023, 2:25pm UTC](https://community.auth0.com/t/references-jwt-versions-over-years/118770 "2023-10-23T14:25:52Z")
Where do I find References JWT versions and it structures over years. Where do I find the dates and the relevant RFCs? --- ## [JWT token for a subnet](https://community.auth0.com/t/jwt-token-for-a-subnet/117064)
**Author:** [@yeshveer.yadav](https://community.auth0.com/u/yeshveer.yadav)\ **Replies:** 1\ **Last updated:** [September 27, 2023, 1:06pm UTC](https://community.auth0.com/t/jwt-token-for-a-subnet/117064 "2023-09-27T13:06:41Z")
Hi All can we get a JWT token for a subnet. as my docker choose any one IP from from subnet while restart --- ## [Apple StoreKit 2 X5C certificate expired, jwt.io still verifies successfully](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021)
**Author:** [@betaphi](https://community.auth0.com/u/betaphi)\ **Replies:** 1\ **Last updated:** [September 27, 2023, 12:55pm UTC](https://community.auth0.com/t/apple-storekit-2-x5c-certificate-expired-jwt-io-still-verifies-successfully/117021 "2023-09-27T12:55:36Z")
Hello everybody, today I noticed that some of my customer’s StoreKit 2 JWTs wouldn’t be verifiably on my server via a Swift JWT library. However, when pasting the same JWT in jwt.io it would verify successfully. Howeve… --- ## [Golang JWT middleware example: adding validation results to context](https://community.auth0.com/t/golang-jwt-middleware-example-adding-validation-results-to-context/116540)
**Author:** [@mbonnet](https://community.auth0.com/u/mbonnet)\ **Replies:** 2\ **Last updated:** [September 19, 2023, 9:32pm UTC](https://community.auth0.com/t/golang-jwt-middleware-example-adding-validation-results-to-context/116540 "2023-09-19T21:32:12Z")
I am looking at the example for JWT middleware in Go. In my API backend as-is, I use the Echo framework (specifically, based off this example). This is no big issue itself, as Echo has a very useful echo.WrapMiddleware(… --- ## [How to Remove Header Token in laravel?](https://community.auth0.com/t/how-to-remove-header-token-in-laravel/115893)
**Author:** [@dazzlingcva](https://community.auth0.com/u/dazzlingcva)\ **Replies:** 1\ **Last updated:** [September 15, 2023, 4:18pm UTC](https://community.auth0.com/t/how-to-remove-header-token-in-laravel/115893 "2023-09-15T16:18:27Z")
How to Remove Header Token in laravel? --- ## [Empty JWT payload in accessToken is not valid](https://community.auth0.com/t/empty-jwt-payload-in-accesstoken-is-not-valid/115302)
**Author:** [@alex2020](https://community.auth0.com/u/alex2020)\ **Replies:** 4\ **Last updated:** [September 12, 2023, 7:35pm UTC](https://community.auth0.com/t/empty-jwt-payload-in-accesstoken-is-not-valid/115302 "2023-09-12T19:35:21Z")
Hello, I’m using react sdk, the login works and I get an accessToken. But when I want to use this accessToken with my backend (C#) it doens’t work. When I check the token using jwt.io I get the warning “Looks like your … --- ## [JWT.io Debugger does validate at all. Considers ANY secret as valid. How is this possible?](https://community.auth0.com/t/jwt-io-debugger-does-validate-at-all-considers-any-secret-as-valid-how-is-this-possible/115215)
**Author:** [@suchislife801](https://community.auth0.com/u/suchislife801)\ **Replies:** 2\ **Last updated:** [September 11, 2023, 5:30pm UTC](https://community.auth0.com/t/jwt-io-debugger-does-validate-at-all-considers-any-secret-as-valid-how-is-this-possible/115215 "2023-09-11T17:30:30Z")
Go to JWT.io right now and under Verify Signature which contains “your-256-bit-secret” go ahead and type anything in. I mean ANYTHING. What do you see? Signature Verified. Go to JWT.io again, then copy & paste your p… --- ## [Can't validate JWT token](https://community.auth0.com/t/cant-validate-jwt-token/114310)
**Author:** [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Replies:** 9\ **Last updated:** [August 31, 2023, 5:05pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310 "2023-08-31T17:05:54Z")
We used this link to configure our WebApi to validate our tokens: Auth0 ASP.NET Web API (OWIN) SDK Quickstarts: Authorization But we noticed something, if we remove part of the signature in the JWT token, the token is n… --- ## [If the HEADER the same and the PAYLOAD the same, the TOKEN the same?](https://community.auth0.com/t/if-the-header-the-same-and-the-payload-the-same-the-token-the-same/114200)
**Author:** [@13524063481](https://community.auth0.com/u/13524063481)\ **Replies:** 7\ **Last updated:** [August 30, 2023, 3:33am UTC](https://community.auth0.com/t/if-the-header-the-same-and-the-payload-the-same-the-token-the-same/114200 "2023-08-30T03:33:51Z")
if the TOKEN expires, and you login next time, assuming that the HEADER still uses the same algorithm, and the PAYLOAD remains unchanged(the user information remains unchanged), is the calculated signature by the server … --- ## [Incorrect payload data format](https://community.auth0.com/t/incorrect-payload-data-format/104928)
**Author:** [@prisoner544](https://community.auth0.com/u/prisoner544)\ **Replies:** 3\ **Last updated:** [August 29, 2023, 4:37pm UTC](https://community.auth0.com/t/incorrect-payload-data-format/104928 "2023-08-29T16:37:19Z")
When I am getting the token after login, But when I want to verify in jwt.io the payload data is something like this: “{"id":"643da67379850�\\u0012�\\u0013\\u001d\\n\\u0010P�\\u0007.�+\\u0018����n˽L���NL�\\f�\\b�^\\u001c\\b��M�\\u0… --- ## [Cannot get custom claim via C#](https://community.auth0.com/t/cannot-get-custom-claim-via-c/113466)
**Author:** [@hungtk243](https://community.auth0.com/u/hungtk243)\ **Replies:** 1\ **Last updated:** [August 14, 2023, 3:59pm UTC](https://community.auth0.com/t/cannot-get-custom-claim-via-c/113466 "2023-08-14T15:59:34Z")
Dear, I can’t get my custom claim in access token. This my action Post login. and this link api for login after login sussessful, redirect to Callback url with access\_token Then, i copy access\_token on … --- ## [See the roles of users in the accestoken](https://community.auth0.com/t/see-the-roles-of-users-in-the-accestoken/113173)
**Author:** [@auth0-ikearg](https://community.auth0.com/u/auth0-ikearg)\ **Replies:** 3\ **Last updated:** [August 11, 2023, 4:22pm UTC](https://community.auth0.com/t/see-the-roles-of-users-in-the-accestoken/113173 "2023-08-11T16:22:49Z")
How can I see the roles in my user token when I log into my react application with auth0? Now I have the ESSENTIALS plan. --- ## [Auth0 SPA Session TTL Part 2](https://community.auth0.com/t/auth0-spa-session-ttl-part-2/112731)
**Author:** [@nikhil.batta](https://community.auth0.com/u/nikhil.batta)\ **Replies:** 2\ **Last updated:** [August 10, 2023, 2:50pm UTC](https://community.auth0.com/t/auth0-spa-session-ttl-part-2/112731 "2023-08-10T14:50:51Z")
Continuing the discussion from Auth0 SPA Session TTL Is lock.checkSession supposed to catch this max\_age thing? I’m using the auth0lock and on intiial login I see the max\_age parameter getting passed to the authorize fu… --- ## [How can I add my JWT library for PHP to JWT.io website?](https://community.auth0.com/t/how-can-i-add-my-jwt-library-for-php-to-jwt-io-website/112460)
**Author:** [@alireza](https://community.auth0.com/u/alireza)\ **Replies:** 3\ **Last updated:** [August 2, 2023, 7:39pm UTC](https://community.auth0.com/t/how-can-i-add-my-jwt-library-for-php-to-jwt-io-website/112460 "2023-08-02T19:39:44Z")
I have created my own JWT library for PHP and now I’m interested in publishing it on JWT.io website, how can i do it? --- ## [Get refresh token when requesting client credentials](https://community.auth0.com/t/get-refresh-token-when-requesting-client-credentials/111184)
**Author:** [@omar.elsafwany](https://community.auth0.com/u/omar.elsafwany)\ **Replies:** 5\ **Last updated:** [July 18, 2023, 1:45pm UTC](https://community.auth0.com/t/get-refresh-token-when-requesting-client-credentials/111184 "2023-07-18T13:45:52Z")
I am currently requesting client\_credentials to receive access token and be able to access certain endpoints with it accordingly. The current issue is that the response does not contain refresh\_token and from what I unde… --- ## [JsonWebToken: jwt malformed even after I get a token is sent](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672)
**Author:** [@DS-LIT](https://community.auth0.com/u/DS-LIT)\ **Replies:** 4\ **Last updated:** [June 27, 2023, 7:01pm UTC](https://community.auth0.com/t/jsonwebtoken-jwt-malformed-even-after-i-get-a-token-is-sent/109672 "2023-06-27T19:01:15Z")
Hey, So I have started to build myself a full stack app, at the moment using apollo server, apollo client, graphql , react and Auth0. I have followed every piece of documentation and read so many bugs. I keep getting jwt… --- ## [Is there any way to expire or revoke bearer access token on logout event of dot net core application](https://community.auth0.com/t/is-there-any-way-to-expire-or-revoke-bearer-access-token-on-logout-event-of-dot-net-core-application/104370)
**Author:** [@nitin.neetu](https://community.auth0.com/u/nitin.neetu)\ **Replies:** 5\ **Last updated:** [June 26, 2023, 6:57am UTC](https://community.auth0.com/t/is-there-any-way-to-expire-or-revoke-bearer-access-token-on-logout-event-of-dot-net-core-application/104370 "2023-06-26T06:57:03Z")
Is there any way to expire or revoke bearer access token on logout event (before it’s expires\_in time which is set in issued token) of dot net core application --- ## [Unable to create custom claim with special character in the claim name](https://community.auth0.com/t/unable-to-create-custom-claim-with-special-character-in-the-claim-name/109670)
**Author:** [@venkatasandeep.kolis](https://community.auth0.com/u/venkatasandeep.kolis)\ **Replies:** 2\ **Last updated:** [June 21, 2023, 6:39pm UTC](https://community.auth0.com/t/unable-to-create-custom-claim-with-special-character-in-the-claim-name/109670 "2023-06-21T18:39:16Z")
I am trying to create an access token with a custom claim with a special character in the claim name(ex: user\_email) but I see the generated token is not taking up the claim. but I was successful with a special characte… --- ## [Scope Added to the role is not getting assigned to the user with that role](https://community.auth0.com/t/scope-added-to-the-role-is-not-getting-assigned-to-the-user-with-that-role/109053)
**Author:** [@gaurav1](https://community.auth0.com/u/gaurav1)\ **Replies:** 2\ **Last updated:** [June 16, 2023, 11:35am UTC](https://community.auth0.com/t/scope-added-to-the-role-is-not-getting-assigned-to-the-user-with-that-role/109053 "2023-06-16T11:35:09Z")
I am assigning scope to the particular role by calling auth0 api from the C# .net project. And, scope is assigned correctly to the role. But, the problem is that, the scope is not getting assigned to the user with that r… --- ## [Really stuck on instantiating the Auth0 PHP SDK](https://community.auth0.com/t/really-stuck-on-instantiating-the-auth0-php-sdk/94582)
**Author:** [@acalpixca](https://community.auth0.com/u/acalpixca)\ **Replies:** 4\ **Last updated:** [June 8, 2023, 4:50am UTC](https://community.auth0.com/t/really-stuck-on-instantiating-the-auth0-php-sdk/94582 "2023-06-08T04:50:42Z")
Hi, just going crazy following this tutorial. https://auth0.com/docs/quickstart/backend/php/01-authorization#integrating-your-php-backend-api To cut a long story short, instantiating the SDK is not working for me. It t… --- ## [Add data on Access Token - avoid Rules and Hooks](https://community.auth0.com/t/add-data-on-access-token-avoid-rules-and-hooks/107843)
**Author:** [@douglas.freitas](https://community.auth0.com/u/douglas.freitas)\ **Replies:** 3\ **Last updated:** [May 26, 2023, 6:10pm UTC](https://community.auth0.com/t/add-data-on-access-token-avoid-rules-and-hooks/107843 "2023-05-26T18:10:18Z")
Hi Team, I receive an email inform the Rules and Hooks will be discontinued. I use Rule to add user data on ID\_TOKEN. How I can add custom information on ID\_TOKEN? Sample fo Rule: function (user, context, callback) { … --- ## [Invalid Signature](https://community.auth0.com/t/invalid-signature/106493)
**Author:** [@chay.n1006](https://community.auth0.com/u/chay.n1006)\ **Replies:** 9\ **Last updated:** [May 26, 2023, 6:02pm UTC](https://community.auth0.com/t/invalid-signature/106493 "2023-05-26T18:02:36Z")
Hi, when I opened Jwt.io the default token is showing Signature Verified after copying the default token if I again paste it in the Encoded section it is showing signature as invalid please have a look at the below sc… --- ## [JWT invalid signature in Mobile + API (Swift + Django)](https://community.auth0.com/t/jwt-invalid-signature-in-mobile-api-swift-django/106960)
**Author:** [@ferranconde](https://community.auth0.com/u/ferranconde)\ **Replies:** 3\ **Last updated:** [May 17, 2023, 6:25pm UTC](https://community.auth0.com/t/jwt-invalid-signature-in-mobile-api-swift-django/106960 "2023-05-17T18:25:14Z")
Hello everyone, I’m implementing an iOS application that needs to communicate with a Python/Django backend. For that, I am following the Mobile + API architecture scenario. Instead of Android and Node.js, I am following… --- ## [/userinfo API returns 401 Unauthorized](https://community.auth0.com/t/userinfo-api-returns-401-unauthorized/105157)
**Author:** [@Ilanoh](https://community.auth0.com/u/Ilanoh)\ **Replies:** 5\ **Last updated:** [May 12, 2023, 12:06am UTC](https://community.auth0.com/t/userinfo-api-returns-401-unauthorized/105157 "2023-05-12T00:06:18Z")
I’m trying to retrieve user’s profile based on the Auth0 Access Token obtained during login. I use the endpoint GET /userinfo I successfully retrieve the Access Token using this function const getUserMetadata = async … --- ## [Error: RSA signing keys must be PrivateKey instances](https://community.auth0.com/t/error-rsa-signing-keys-must-be-privatekey-instances/106519)
**Author:** [@lucascardozo73](https://community.auth0.com/u/lucascardozo73)\ **Replies:** 4\ **Last updated:** [May 10, 2023, 3:50pm UTC](https://community.auth0.com/t/error-rsa-signing-keys-must-be-privatekey-instances/106519 "2023-05-10T15:50:01Z")
When i try to post my login with user and password, the only return is: RSA signing keys must be PrivateKey instances. What should i do to solve it? --- ## [Difference between sending OAuth codes and jwt tokens in URL query security](https://community.auth0.com/t/difference-between-sending-oauth-codes-and-jwt-tokens-in-url-query-security/106312)
**Author:** [@iKingNinja](https://community.auth0.com/u/iKingNinja)\ **Replies:** 1\ **Last updated:** [May 10, 2023, 12:42am UTC](https://community.auth0.com/t/difference-between-sending-oauth-codes-and-jwt-tokens-in-url-query-security/106312 "2023-05-10T00:42:33Z")
Why is passing OAuth codes in the URL’s query considered safe while doing it with JWTs is not? If an OAuth code is leaked, the attacker can use it to retrieve the bearer token thus getting access to the user’s resources… --- ## [Why my token has 2 dots (..) in it?](https://community.auth0.com/t/why-my-token-has-2-dots-in-it/106186)
**Author:** [@dominic.bouchard.355](https://community.auth0.com/u/dominic.bouchard.355)\ **Replies:** 3\ **Last updated:** [May 9, 2023, 3:23pm UTC](https://community.auth0.com/t/why-my-token-has-2-dots-in-it/106186 "2023-05-09T15:23:18Z")
I’m using apollo server, Auth0 and jwt/jwksClient for my app authentication. When I look at the token my front end is sending to the back-end it has 2 dots inside which indicates its only signed. When decrypting in the … [Previous page](https://community.auth0.com/c/jwt/8.md?page=1) [Next page](https://community.auth0.com/c/jwt/8.md?page=3)