How to access case-sensitive username in backend API?

[James.Morrison]

@jrp-23

as soon as I get the id token back from Auth0, i.e. after calling webAuth.authorize() , do I need to validate it right away prior to decoding it? Or can I just decode it without validating it? The reason I ask is because I found jwt-decode which states the below - indicating that validation should take place on the server. Is this the case (or is that more in reference to access tokens rather than ID tokens)? If it is recommended to validate an ID token on the client, do you have any example code of how to do this (in React Native)?

I was able to confirm the best practice is to validate first before decoding. I’ve shared some documentation on this front below.

Validate JSON Web Tokens

Validate ID Tokens

Mitigate Replay Attacks When Using the Implicit Flow

@jrp-23

Do you have any more info regarding my original question/issue related to the case-sensitive username

Building out another test example of this. I will keep you posted.