Basic question about resolving a token

[kkrp1]

I’ve read a tonne of documentation and somehow I’m still a little unsure precisely what I should recall on my back-end (using the Node.js SDK) to resolve a passed user token (i.e. the token that is the result of a successful universal login).

In the docs for the SDK there’s the getProfile method - is this the authoritative source of whether a token is valid, or is there some other method/endpoint I should be calling?

Many thanks.

[tyf]

Hey @kkrp1!

@kkrp1

In the docs for the SDK there’s the getProfile method - is this the authoritative source of whether a token is valid, or is there some other method/endpoint I should be calling?

Assuming you are working on your backend, you will be concerned with validating an access token. I definitely recommend checking out this library.

This blog post should be helpful as well:

Introducing the OAuth 2.0 Express SDK for Protecting APIs with JWT Bearer Tokens

Cheers!

[kkrp1]

Thanks. I’m just trying to figure out the back-end part of the flow. I’m really new to all this and haven’t used JWT before.

So are you saying that my back-end, on being passed an auth token (i.e. a JWT), should first validate it with the library you linked to, and then call the getProfile endpoint on Auth0? Is it these TWO steps which, combined, constitute the successful confirmation that a JWT represents an authenticated user, or just the first (the second (get profile) being necessary only if you actually want the profile details)?

Wouldn’t merely calling getProfile suffice, without validating the JWT first? I’m speaking from total ignorance here so this is probably a terrible idea, but I’m just trying to get it clear in my head. Surely if I do nothing other than try to get profile, that either succeeds (the JWT was valid) or fails (it wasn’t), ergo that step alone constitutes validating the token?

I realise I’m asking some real basics here so I appreciate your patience and help!

[tyf]

No problem, happy to help!

@kkrp1

Wouldn’t merely calling getProfile suffice, without validating the JWT first?

Technically speaking, because getProfile does require a valid access (it’ll throw an error if not) it could serve as a rudimentary check on the access token. It is just not best practice as it does more than just validate the token - Validating the token first and then performing subsequent actions makes more sense as your use case becomes more complex (as opposed to relying on getProfile).

Hope this helps to clarify!

[kkrp1]

Thank you! So just to wrap this up, you’re saying I should first validate the JWT, using the library you mentioned. When I do this, could you clarify what precisely I’m looking for in that validation? Am I checking for a particular item in the decoded token? And only then, if we pass that stage, do I call getProfile(), right?

Continued thanks!

[tyf]

Linking to the post below as I believe it answers this question as well:

JWT token is "invalid signature"?

Hey @kkrp1 ! Again, this all comes down to the audience - This would be passed to getTokenSilently via authorizationParams. If the only thing you are doing is using the access token to call /userinfo then you are correct in that you do not need an audience, nor do you need to validate the token per se. In most cases, the access token is used to access an API (your API) and in that case you’d want a JWT to inspect which does require an audience (your API identifier in Auth0) as you’ve seen.

Hopefully this clears things up for you