active-directory-dotnet-webapi-manual-jwt-validation | manually process a JWT access token | Authentication library

ID tokens are considered valid until their expiry. Usually, a web application matches a user’s session lifetime in the application to the lifetime of the ID token issued for the user. You can adjust the lifetime of an ID token to control how often the web application expires the application session, and how often it requires the user to be reauthenticated with Azure AD (either silently or interactively).

Access Token Lifetime policy controls how long access and ID tokens for this resource are considered valid. Reducing the Access Token Lifetime property mitigates the risk of an access token or ID token being used by a malicious actor for an extended period of time. (These tokens cannot be revoked.) The trade-off is that performance is adversely affected, because the tokens have to be replaced more often.

To create the policy, run this command:

PowerShell

Do I need to validate the tokens or is the middleware doing it for me?

The JWT bearer middleware does it for you (by default, it will automatically reject unsigned or counterfeit tokens, so you don't need to explicitly set RequireSignedTokens to true).

Doesn't that defeat the purpose?

There's a difference between validating a signature using a public asymmetric key (e.g RSA or ECDSA) embedded in a certificate and validating the certificate itself (and specially its chain). Signature validation is fully supported in ASP.NET Core, but certificate validation is not supported yet.

Don't I have to have the signing key from B2C and all that?

The JWT bearer middleware automatically retrieves it from B2C's discovery endpoint, so there's no need to do that manually. For more information, don't hesitate to read the OIDC discovery specification: https://openid.net/specs/openid-connect-discovery-1_0.html