# JWT.io **URL:** https://community.auth0.com/c/jwt/8.md?page=8 [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) **Page:** 9 --- ## [Why JWT verify tampered tokens?](https://community.auth0.com/t/why-jwt-verify-tampered-tokens/17441)
**Author:** [@gamero.sa](https://community.auth0.com/u/gamero.sa)\ **Replies:** 3\ **Last updated:** [November 5, 2018, 7:34pm UTC](https://community.auth0.com/t/why-jwt-verify-tampered-tokens/17441 "2018-11-05T19:34:45Z")
Hey,! I’ve been doing tests with jwt.io token example and I don’t get why JWT Debugger verifies this token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyf… --- ## [Authorization extension, roles and permissions always empty if user group is empty](https://community.auth0.com/t/authorization-extension-roles-and-permissions-always-empty-if-user-group-is-empty/17463)
**Author:** [@yapith](https://community.auth0.com/u/yapith)\ **Replies:** 4\ **Last updated:** [November 5, 2018, 2:50pm UTC](https://community.auth0.com/t/authorization-extension-roles-and-permissions-always-empty-if-user-group-is-empty/17463 "2018-11-05T14:50:20Z")
My config: SPA Application Google App enterprise connection REPRO STEP: 0. with authorization extension configured (all groups, roles, and permissions) create role (roleA) assign a user (userA) with roleA make sur… --- ## [Why JWT tokens look different from refresh\_token? how can I generate a refresh token?](https://community.auth0.com/t/why-jwt-tokens-look-different-from-refresh-token-how-can-i-generate-a-refresh-token/17009)
**Author:** [@fddayan](https://community.auth0.com/u/fddayan)\ **Replies:** 1\ **Last updated:** [November 5, 2018, 1:30pm UTC](https://community.auth0.com/t/why-jwt-tokens-look-different-from-refresh-token-how-can-i-generate-a-refresh-token/17009 "2018-11-05T13:30:54Z")
I;m trying to get my idea around refresh tokens. How do I generate a refresh token? why they look different? Is it related to the JWT format? --- ## [How to verify signature in the debugger for RS256?](https://community.auth0.com/t/how-to-verify-signature-in-the-debugger-for-rs256/16773)
**Author:** [@uclaeagit](https://community.auth0.com/u/uclaeagit)\ **Replies:** 1\ **Last updated:** [October 24, 2018, 1:06am UTC](https://community.auth0.com/t/how-to-verify-signature-in-the-debugger-for-rs256/16773 "2018-10-24T01:06:52Z")
Does verify signature in the jwt debugger work with RSA256? I’ve tried tons of different encodings and nothing I can do gets it to show signature verified. But I know it’s good as I’m verifying it with the client-side js… --- ## [X509 certificate in header](https://community.auth0.com/t/x509-certificate-in-header/16749)
**Author:** [@sai.jav3](https://community.auth0.com/u/sai.jav3)\ **Replies:** 3\ **Last updated:** [October 16, 2018, 1:24pm UTC](https://community.auth0.com/t/x509-certificate-in-header/16749 "2018-10-16T13:24:50Z")
Hello Everyone, Is there a way i can add the certificate and generate a token. I am trying to add it in the header for RS256 algorithm. Please advise would i be able to generate the token with the cert. --- ## [Lock v11: getUserInfo does not work with token from "lock.checkSession"](https://community.auth0.com/t/lock-v11-getuserinfo-does-not-work-with-token-from-lock-checksession/15158)
**Author:** [@dienste](https://community.auth0.com/u/dienste)\ **Replies:** 3\ **Last updated:** [October 2, 2018, 3:29am UTC](https://community.auth0.com/t/lock-v11-getuserinfo-does-not-work-with-token-from-lock-checksession/15158 "2018-10-02T03:29:22Z")
Hi, I’m trying to implement a PopUp login with Lock v11 in my javascript app. It works: I can authorize and get user data. But only on login. If I try to refresh the token with lock.checkSession() and use this token to … --- ## [.NET Core 2 and JS](https://community.auth0.com/t/net-core-2-and-js/15374)
**Author:** [@Tomasz](https://community.auth0.com/u/Tomasz)\ **Replies:** 7\ **Last updated:** [October 1, 2018, 9:30pm UTC](https://community.auth0.com/t/net-core-2-and-js/15374 "2018-10-01T21:30:23Z")
Hello guys. I tried to create .NET Core 2 app which uses only REST API. To consume this API I want to use Vanila JS or Jquery. I played around with a sample app: “ASP.NET Core v2.0: Login” (in github: auth0-aspnetcore-… --- ## [Token Renewal for User Session](https://community.auth0.com/t/token-renewal-for-user-session/15541)
**Author:** [@baleshwar](https://community.auth0.com/u/baleshwar)\ **Replies:** 2\ **Last updated:** [September 27, 2018, 2:54pm UTC](https://community.auth0.com/t/token-renewal-for-user-session/15541 "2018-09-27T14:54:47Z")
Hi, I have integrated Auth0 lock for authentication and trying to re-new ID token using this.auth0.checkSession(). It is always throwing error “login required” with social login only but in other case it working fine. … --- ## [Where to store JWT?](https://community.auth0.com/t/where-to-store-jwt/15949)
**Author:** [@vivekgangotri](https://community.auth0.com/u/vivekgangotri)\ **Replies:** 1\ **Last updated:** [September 26, 2018, 3:46pm UTC](https://community.auth0.com/t/where-to-store-jwt/15949 "2018-09-26T15:46:55Z")
where to store JWT ? I researched for JWT storage, some says localstorage / cookie/ etc… So which one will be better in terms of protection --- ## [jQuery Login not working in Zendesk App](https://community.auth0.com/t/jquery-login-not-working-in-zendesk-app/12729)
**Author:** [@kabindrasimkhada](https://community.auth0.com/u/kabindrasimkhada)\ **Replies:** 1\ **Last updated:** [September 6, 2018, 9:14pm UTC](https://community.auth0.com/t/jquery-login-not-working-in-zendesk-app/12729 "2018-09-06T21:14:03Z")
I am integrating Auth0 in my zendesk application. When I try login using jQuery Login the redirect URL part is not working. var AUTH0\_DOMAIN = '{DOMAIN}', AUTH0\_CLIENT\_ID = '{CLIENTID}', AUTH0\_CALLBACK\_URL = window.loca… --- ## [Auth0LockPasswordless returns JWT with default scope instead of specified scope](https://community.auth0.com/t/auth0lockpasswordless-returns-jwt-with-default-scope-instead-of-specified-scope/13990)
**Author:** [@Syntaf1](https://community.auth0.com/u/Syntaf1)\ **Replies:** 4\ **Last updated:** [September 6, 2018, 7:04pm UTC](https://community.auth0.com/t/auth0lockpasswordless-returns-jwt-with-default-scope-instead-of-specified-scope/13990 "2018-09-06T19:04:47Z")
I can’t seem to figure out why my login authentication only returns the default scope even though I’m specifying one. Here’s what my lock configuration looks like: private lock = new Auth0LockPasswordless(authConfig.cli… --- ## [Simple SSO with JWT](https://community.auth0.com/t/simple-sso-with-jwt/12447)
**Author:** [@nikolay.cheltsov](https://community.auth0.com/u/nikolay.cheltsov)\ **Replies:** 1\ **Last updated:** [September 6, 2018, 2:49pm UTC](https://community.auth0.com/t/simple-sso-with-jwt/12447 "2018-09-06T14:49:20Z")
Hello guys, I totally got lost in the aut0 documentation and something that I thought should be simple now seems a nightmare. I want: To use auth0 as SSO for my application with multiple users Be redirected to login … --- ## [Auth0 Lock 11 and Refresh Token](https://community.auth0.com/t/auth0-lock-11-and-refresh-token/14828)
**Author:** [@gordonlimusic1](https://community.auth0.com/u/gordonlimusic1)\ **Replies:** 1\ **Last updated:** [August 30, 2018, 6:26pm UTC](https://community.auth0.com/t/auth0-lock-11-and-refresh-token/14828 "2018-08-30T18:26:31Z")
Right now I"m implementing the basic lock with an SPA (Single Page Application). Because of this, after the access token expires, the user is logged out and has to log back in. I read that I need a refresh token so I can… --- ## [Getting error with Safari](https://community.auth0.com/t/getting-error-with-safari/12795)
**Author:** [@umeshkolhe.89](https://community.auth0.com/u/umeshkolhe.89)\ **Replies:** 11\ **Last updated:** [July 24, 2018, 2:14pm UTC](https://community.auth0.com/t/getting-error-with-safari/12795 "2018-07-24T14:14:03Z")
We are getting error with Safari, while we are used the “angular2-jwt and lock 11.7.2”. Safari shows “ReferenceError: Can’t find variable: Auth0Lock” I’ve seen a similar post, but no solutions that worked for me. I ho… --- ## [Creating a login endpoint for asp.net api](https://community.auth0.com/t/creating-a-login-endpoint-for-asp-net-api/12444)
**Author:** [@shehan.f](https://community.auth0.com/u/shehan.f)\ **Replies:** 4\ **Last updated:** [July 18, 2018, 4:09am UTC](https://community.auth0.com/t/creating-a-login-endpoint-for-asp-net-api/12444 "2018-07-18T04:09:58Z")
Hi all, I’v been stuck with a process of authenticating a user from a web API. Here is my scenario, I have a web API where i need to get user credentials and authenticate that user against auth0 and send that incoming a… --- ## [How can I script using Python/Ruby to get a full IdToken](https://community.auth0.com/t/how-can-i-script-using-python-ruby-to-get-a-full-idtoken/12518)
**Author:** [@systems1](https://community.auth0.com/u/systems1)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 2:56pm UTC](https://community.auth0.com/t/how-can-i-script-using-python-ruby-to-get-a-full-idtoken/12518 "2018-06-29T14:56:39Z")
I need to accomplish a login flow to get a full IdToken, but not from my app but from a script instead. I tried looking at the API Authentication but couldn’t get it done. Could you please provide some help on how to sc… --- ## [Can I get custom claims from another source?](https://community.auth0.com/t/can-i-get-custom-claims-from-another-source/12603)
**Author:** [@jstafford](https://community.auth0.com/u/jstafford)\ **Replies:** 1\ **Last updated:** [June 27, 2018, 1:27pm UTC](https://community.auth0.com/t/can-i-get-custom-claims-from-another-source/12603 "2018-06-27T13:27:45Z")
I’m not sure what the intended practice is for custom claims. It seems that I’m supposed to create a rule that adds them to the access token. The example creates a claim from the user profile, but what if I need to retri… --- ## [Valid JWT using curl, not when using node.js](https://community.auth0.com/t/valid-jwt-using-curl-not-when-using-node-js/9703)
**Author:** [@kurt.sys](https://community.auth0.com/u/kurt.sys)\ **Replies:** 2\ **Last updated:** [June 23, 2018, 3:41pm UTC](https://community.auth0.com/t/valid-jwt-using-curl-not-when-using-node-js/9703 "2018-06-23T15:41:27Z")
I’m trying to get a valid JWT from a node.js application. I can make it work using cURL: curl th0.com/oauth/token --header 'content-type: application/json' --data '{"client\_id":\,"client\_secret":\ **Author:** [@shehan.f](https://community.auth0.com/u/shehan.f)\ **Replies:** 1\ **Last updated:** [December 19, 2018, 11:49am UTC](https://community.auth0.com/t/asp-net-web-api-tutorial-example-issue/12347 "2018-12-19T11:49:13Z") Hi everyone. since the above topic is mostly popular i think most of you who reads this know the issue. I did the research and read bunch of threads regarding this issue still couldn’t figure out a way. And i’m kinda ne… --- ## [Mobile game needs to prevent unauthorized users from accessing REST APIs](https://community.auth0.com/t/mobile-game-needs-to-prevent-unauthorized-users-from-accessing-rest-apis/12158)
**Author:** [@cliffbarker](https://community.auth0.com/u/cliffbarker)\ **Replies:** 3\ **Last updated:** [June 11, 2018, 9:23pm UTC](https://community.auth0.com/t/mobile-game-needs-to-prevent-unauthorized-users-from-accessing-rest-apis/12158 "2018-06-11T21:23:31Z")
We have a mobile game. It makes REST services calls to our custom APIs. Currently we require the username and password of the logged in user with each request. We want to prevent any other clients (web, mobile, etc) fr… --- ## [Couldn't using Signature Algorithm RS256](https://community.auth0.com/t/couldnt-using-signature-algorithm-rs256/12167)
**Author:** [@sunary](https://community.auth0.com/u/sunary)\ **Replies:** 1\ **Last updated:** [December 19, 2018, 11:21am UTC](https://community.auth0.com/t/couldnt-using-signature-algorithm-rs256/12167 "2018-12-19T11:21:22Z")
I set JsonWebToken Signature Algorithm is RS256, but express-jwt lib and jwt.io dectect that is HS256? below is my token generated from auth0.com: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3BzdWNvZGVyL… --- ## [Custom Claims in Token](https://community.auth0.com/t/custom-claims-in-token/12095)
**Author:** [@neil2](https://community.auth0.com/u/neil2)\ **Replies:** 3\ **Last updated:** [June 6, 2018, 5:17pm UTC](https://community.auth0.com/t/custom-claims-in-token/12095 "2018-06-06T17:17:15Z")
Hello, When a Jwt token is generated I would like to include some custom user claims that only exist in my user database. Is this possible or do all claims need to exist as pre-defined attributes in Auth0. I have my own… --- ## [Google API Login + OAuth 2.0](https://community.auth0.com/t/google-api-login-oauth-2-0/11482)
**Author:** [@stevenosan](https://community.auth0.com/u/stevenosan)\ **Replies:** 1\ **Last updated:** [June 4, 2018, 10:54pm UTC](https://community.auth0.com/t/google-api-login-oauth-2-0/11482 "2018-06-04T22:54:44Z")
Context: I’m trying to make a back end api that utilizes the google auth api through auth0. This is a .Net core 2.0 webapi solution I’ve downloaded the primer solution. Using postman, I can’t seem to get the auth0 prim… --- ## [What validity tests make sense on client side](https://community.auth0.com/t/what-validity-tests-make-sense-on-client-side/12059)
**Author:** [@simonh1000](https://community.auth0.com/u/simonh1000)\ **Replies:** 1\ **Last updated:** [June 3, 2018, 5:43pm UTC](https://community.auth0.com/t/what-validity-tests-make-sense-on-client-side/12059 "2018-06-03T17:43:17Z")
What can I do to test validity of a JWT on the client side. I realise that I can NOT test against the secret key. Tests I can think of: three sections header and the body need to represent json objects Are there any … --- ## [Lambda Custom Authorizer - Error: Auth0 empty return](https://community.auth0.com/t/lambda-custom-authorizer-error-auth0-empty-return/11309)
**Author:** [@bror](https://community.auth0.com/u/bror)\ **Replies:** 3\ **Last updated:** [May 2, 2018, 4:00pm UTC](https://community.auth0.com/t/lambda-custom-authorizer-error-auth0-empty-return/11309 "2018-05-02T16:00:00Z")
I have built an AWS Lambda custom authorizer based on: GitHub - auth0-samples/jwt-rsa-aws-custom-authorizer: An AWS Custom Authorizer for AWS Gateway that support Auth0 Bearer tokens. · GitHub. It works locally, but when… --- ## [Where can I set the Standard Claims?](https://community.auth0.com/t/where-can-i-set-the-standard-claims/10354)
**Author:** [@akim](https://community.auth0.com/u/akim)\ **Replies:** 3\ **Last updated:** [May 1, 2018, 5:02pm UTC](https://community.auth0.com/t/where-can-i-set-the-standard-claims/10354 "2018-05-01T17:02:34Z")
Hi, in the response of the JWT. I want to have the standard claims, for example, Phone\_number. But I don’t know where I can set it. I only can get the following json. I have tried to use rules, but It do not work. Can an… --- ## [Missing jwt custom claim after sign up](https://community.auth0.com/t/missing-jwt-custom-claim-after-sign-up/11245)
**Author:** [@david.hong](https://community.auth0.com/u/david.hong)\ **Replies:** 1\ **Last updated:** [May 1, 2018, 2:27pm UTC](https://community.auth0.com/t/missing-jwt-custom-claim-after-sign-up/11245 "2018-05-01T14:27:25Z")
Hi, I have setup rule to assign custom attribute to user\_metadata via auth0.user.updateUsermetadata and assign custom claim on id\_token. (Both database connection + social login) Custom claims was return for login toke… --- ## [How to create a custom authorizer that serves a public+private endpoint?](https://community.auth0.com/t/how-to-create-a-custom-authorizer-that-serves-a-public-private-endpoint/11230)
**Author:** [@stephen.jensen.ihi](https://community.auth0.com/u/stephen.jensen.ihi)\ **Replies:** 1\ **Last updated:** [December 18, 2018, 5:55pm UTC](https://community.auth0.com/t/how-to-create-a-custom-authorizer-that-serves-a-public-private-endpoint/11230 "2018-12-18T17:55:11Z")
I want to use auth0 for a graphQL application (using the serverless framework). Since 1 endpoint serves both authorized and unauthorized content, I need a custom authorizer that will allow requests without a JWT, but wil… --- ## [Retrieving the jwks when using multiple JWT issuers](https://community.auth0.com/t/retrieving-the-jwks-when-using-multiple-jwt-issuers/11157)
**Author:** [@eric3](https://community.auth0.com/u/eric3)\ **Replies:** 1\ **Last updated:** [December 18, 2018, 5:53pm UTC](https://community.auth0.com/t/retrieving-the-jwks-when-using-multiple-jwt-issuers/11157 "2018-12-18T17:53:57Z")
I want to verify that my thinking is correct: I currently have an API that will get requests that include JWTs from more than one issuer. These all use RS256. What I’m doing is using the ‘iss’ claim to construct the URL … --- ## [Share valid token](https://community.auth0.com/t/share-valid-token/11113)
**Author:** [@frantisek.kolar1](https://community.auth0.com/u/frantisek.kolar1)\ **Replies:** 1\ **Last updated:** [December 18, 2018, 5:52pm UTC](https://community.auth0.com/t/share-valid-token/11113 "2018-12-18T17:52:55Z")
Hi Team, I wonder if you can help me on this. I have an angular application that is using your auth0 api to login. It retrieves an Token that I save. I also created API out of this auth0 application. Then I have sprin… [Previous page](https://community.auth0.com/c/jwt/8.md?page=7) [Next page](https://community.auth0.com/c/jwt/8.md?page=9)