# Can't validate JWT token **URL:** \ **Category:** JWT.io\ **Tags:** jwt, auth0\ **Created:** [August 23, 2023, 9:29am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310 "2023-08-23T09:29:26Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![AnthonyDaSilva](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anthonydasilva/32/33385_2.png) [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Post date:** [August 23, 2023, 9:29am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/1 "2023-08-23T09:29:26Z")
We used this link to configure our WebApi to validate our tokens: [Auth0 ASP.NET Web API (OWIN) SDK Quickstarts: Authorization](https://auth0.com/docs/quickstart/backend/webapi-owin/01-authorization) But we noticed something, if we remove part of the signature in the JWT token, the token is not rejected. ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [August 23, 2023, 7:42pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/3 "2023-08-23T19:42:57Z")
Hi @AnthonyDaSilva, I recommend checking out our [Validate Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/validate-access-tokens) documentation on how to validate a JWT Token. I will mention that if you remove part of the signature in the JWT Token, you should expect an **Invalid Signature** error. You can verify this by decoding it on [jwt.io](http://jwt.io). If you found this post helpful or interesting, please give it a like šŸ‘ . Your interaction makes a difference. **Have a wonderful day!** šŸŒž Thanks, Rueben ---
**Author:** ![AnthonyDaSilva](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anthonydasilva/32/33385_2.png) [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Post date:** [August 24, 2023, 6:40am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/4 "2023-08-24T06:40:05Z")
Iā€™ll look into it thanks. Shouldnā€™t the middleware configuration prevent call to go through if the token has been modified? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [August 24, 2023, 5:16pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/5 "2023-08-24T17:16:22Z")
Hi @AnthonyDaSilva, Thanks for the reply. The token is allowed to be modified, like adding custom claims. Could you please clarify if the token you decoded is a JWT and has the correct payload? Thanks, Rueben ---
**Author:** ![AnthonyDaSilva](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anthonydasilva/32/33385_2.png) [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Post date:** [August 25, 2023, 6:06am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/6 "2023-08-25T06:06:44Z")
Hi, Sorry for the confusion, I meant by modified if someone with ill intention tries to forge a token or something like that. I removed part of the signature of the token and it worked the same as the full token. Thanks ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [August 25, 2023, 4:36pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/7 "2023-08-25T16:36:31Z")
Hi @AnthonyDaSilva, Thanks for following up. What part of the signature did you remove? Can you please share the token you generated compared to the modified token? And the exact steps and code you used to perform these steps? Thanks, Rueben ---
**Author:** ![AnthonyDaSilva](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anthonydasilva/32/33385_2.png) [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Post date:** [August 28, 2023, 5:53am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/8 "2023-08-28T05:53:30Z")
Hi, For example this one: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InlsUWJxZ2d4b0pCeTNHTkFqdVNPYiJ9.eyJodHRwczovL2V4YW1wbGUuY29tL2VtYWlsIjoiamFpcm8uc290b0BxdWFsaXRzZXJ2aWNlcy50ZWNoIiwiaXNzIjoiaHR0cHM6Ly9maW5hbWljLmV1LmF1dGgwLmNvbS8iLCJzdWIiOiJhdXRoMHw2MzExYzQxZjBmMTc2ZDExMTYwOGM5MDMiLCJhdWQiOlsiaHR0cHM6Ly9wcmVwcm9kLmFyYmlvbmFwcC5jb20vV2ViQXRyaXVtLyIsImh0dHBzOi8vZmluYW1pYy5ldS5hdXRoMC5jb20vdXNlcmluZm8iXSwiaWF0IjoxNjkyODM2OTgzLCJleHAiOjE2OTI5MjMzODMsImF6cCI6Im5vNnZGNTlaUk5hcGpFUjI0WnVDb2gwNXBhWEM1M0tHIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCJ9.kAtw2CHXSK0P-kNxyEDz\_3xFxuEOAvevFjbUYSSQmAPfhn0e16JyCztTFboK-iGigwKKQ6jbpTDPQpb9iv0OlsK1X80ReDAybyfus0q0HQhzc-muU\_k\_W7mDX\_0aFO4\_E3LEiIgMxLMmMw7G4xRtq2SDjNF6a52ZKFPcKioYk8CHWumGz\_ZR1YhTGLW85nRG\_rEjiAlFXS-1s6kCGDo9vdZ1Pb-AQ1S22FDEpbiPc5ZLRz2KYTJmsd\_ERYadHV0IvRxdvZEwSSwyNcu-mt9XIICC1Fjv9PfElnvT7yWdmiodrI55TBO-c5zwqZqjY1tqKtp8G-jA1z5qu8tYzU165 I removed any part by hand before using postman to make a call to my APIs and it went through. ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [August 28, 2023, 5:15pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/9 "2023-08-28T17:15:36Z")
Hi @AnthonyDaSilva, Thanks for providing me with an update! I have just tried decoding your token on [jwt.io](http://jwt.io) and found that you have used the HS256 instead of the RS256 as your signing algorithm. In this situation, this is a totally valid token and can be decoded and used as usual. Thanks, Rueben ---
**Author:** ![AnthonyDaSilva](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/anthonydasilva/32/33385_2.png) [@AnthonyDaSilva](https://community.auth0.com/u/AnthonyDaSilva)\ **Post date:** [August 29, 2023, 6:39am UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/10 "2023-08-29T06:39:31Z")
Hi, Yes, you can decode it but if you look at the bottom left part, you should have a message ā€˜Invalid signatureā€™. Shouldnā€™t the token be rejected if part of the signature (or any part of the token) is missing or has been altered? ---
**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\ **Post date:** [August 31, 2023, 5:05pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/11 "2023-08-31T17:05:54Z")
Hi @AnthonyDaSilva, Thanks for the reply. As far as I can tell, the token you shared is legitimate even after you have altered the signature. I cannot tell what you have removed/changed in the signature, but when I decode it, it has a valid signature. I have sent you a screenshot of the decoded token in direct messages for your reference. In this case, can you clarify exactly what steps you took to modify the signature of the token? Thanks, Rueben ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [September 14, 2023, 5:06pm UTC](https://community.auth0.com/t/cant-validate-jwt-token/114310/12 "2023-09-14T17:06:18Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.