title: Do I need to validate JWT tokens in asp.net core 2 REST API?
body: <p>I have the following code in my asp.net core REST API configuration:</p>
  
  <pre><code>services
      .AddAuthentication(options =&gt; { options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme; })
      .AddJwtBearer(options =&gt;
          {
              options.Authority = "https://login.microsoftonline.com/XXXTenantIDXXX";
              options.Audience = "XXXX clientId XXXX";
          });
  
  services.AddMvc(o =&gt;
      {
          var policy = new AuthorizationPolicyBuilder()
              .RequireAuthenticatedUser()
              .Build();
          o.Filters.Add(new AuthorizeFilter(policy));
  </code></pre>
  
  <p>It authenticates requests. It is working fine.</p>
  
  <p>I am concerned and worried about jwt token forgery or jwt tokens that come from other AAD applications in the tenant.</p>
  
  <p>I expect above code provides all the information to the asp.net core authentication to verify the jwt is valid and its audience is the right AAD application.</p>
  
  <p>I wanted to confirm my expectation here and ask if I need to have additional logic (code) to verify the JWT token?</p>