# Does the API communicate with Auth0 servers

**URL:** <https://community.auth0.com/t/does-the-api-communicate-with-auth0-servers/7927>\
**Category:** Get Help\
**Tags:** api-authorization, api, spring-security-api\
**Created:** [August 22, 2017, 1:16pm UTC](https://community.auth0.com/t/does-the-api-communicate-with-auth0-servers/7927 "2017-08-22T13:16:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![max.critical.path.te](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@max.critical.path.te](https://community.auth0.com/u/max.critical.path.te)\
**Post date:** [August 22, 2017, 1:16pm UTC](https://community.auth0.com/t/does-the-api-communicate-with-auth0-servers/7927/1 "2017-08-22T13:16:31Z")

</div>

We are following the API quickstart at:

> **[Java Springboot API - Auth0 Docs](https://auth0.com/docs/quickstart/backend/java-spring-security5)**
>
> Add Auth0 JWT authentication to a Spring Boot API with protected endpoints

We have it working and can hit authorized end points.

In the class SecurityConfig which does the pattern matching and authorization

Question 1 .

Does this class communicate with the Auth0 servers to validate a token that comes in ? Or does it just parse the token and check the token’s format and expiry date ?

Question 2.

If this is just a token parser, what is stopping people spoofing the token, i.e. create a fake token with fake credentials and a new expiry date ?

---

<div class="post-metadata">

**Author:** ![jmangelo](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jmangelo/32/7923_2.png) [@jmangelo](https://community.auth0.com/u/jmangelo)\
**Post date:** [August 29, 2017, 5:27pm UTC](https://community.auth0.com/t/does-the-api-communicate-with-auth0-servers/7927/2 "2017-08-29T17:27:21Z")

</div>

Following the quickstart you linked you will use the `JwtWebSecurityConfigurer` class with the `forRS256` method. This implies that the received access token will be validated by obtaining the public key of the certificate used to sign the token from the Auth0 service and then performing a signature verification step. The public key is cached so that it does not need to be obtained in every request.

In conclusion, to answer your questions, the token is validated so if you try to pass a token that was not signed by the certificate associated with your Auth0 account the verification will fail even if the token has a valid format or expiration.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:56am UTC](https://community.auth0.com/t/does-the-api-communicate-with-auth0-servers/7927/3 "2018-03-02T05:56:03Z")

</div>