Should I be validating JWT on my back-end with or without secret?

[tyf]

Hey @kkrp1 !

@kkrp1

So do I need the first approach, which doesn’t use secret, or the second, which does? I’m quite new to JWT. I just want to know that I’m doing this securely.

Great question! It depends on which algorithm you’re using to sign tokens (you can check in your application settings → advanced → oauth tab as well as in your API settings)- Typically this will be RS256 which is asymmetric, won’t include using a secret, and is generally considered more secure. HS256 is symmetric and requires a secret. Some further resources on this topic:

RS256 vs HS256 JWT signing algorithms

Question: What’s the difference between RS256 and HS256 JWT signing algorithms? TLDR; RS256 and HS256 are algorithms used for signing a JWT. RS256 is an asymmetric algorithm, meaning it uses a public and private key pair. HS256 is a symmetric algorithm, meaning it uses a shared secret. Auth0 uses RS256 as the default signing algorithm in JWTs. We recommend that you use RS256 instead of HS256 for several reasons. Answer RS256 and HS256 are two algorithms used for signing a JSON Web Token …

RS256 vs HS256 What's the difference?

Hope this helps to clarify!