Htykuut

I am using AspNet Core to build a web api and JWT tokens to authenticate users.

I see that in TokenValidationParameters the default value of ValidateIssuerSigningKey property is false.

Does it make any difference if we set it to true, when using the HMAC256 Symmetric key to sign and verify tokens (where there is no public-key added to the token like in case of RSA)?

    services

        .AddAuthentication(options =>

        {

            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;

            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

        })

        .AddJwtBearer(cfg =>

        {

            cfg.RequireHttpsMetadata = false;

            cfg.SaveToken = true;

            string jwtIssuer = configuration["JwtIssuer"];

            SymmetricSecurityKey securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["JwtKey"]));

            cfg.TokenValidationParameters = new TokenValidationParameters

            {

                ValidIssuer = jwtIssuer,

                ValidAudience = jwtIssuer,

                ValidateIssuerSigningKey = true,

                IssuerSigningKey = securityKey,

                ClockSkew = TimeSpan.Zero

            };

        });

Or is it necessary to set ValidateIssuerSigningKey to true only when using RSA keys?

Here is the code level documentation of this property:

    //

    // Summary:

    //     Gets or sets a boolean that controls if validation of the Microsoft.IdentityModel.Tokens.SecurityKey

    //     that signed the securityToken is called.

    //

    // Remarks:

    //     It is possible for tokens to contain the public key needed to check the signature.

    //     For example, X509Data can be hydrated into an X509Certificate, which can be used

    //     to validate the signature. In these cases it is important to validate the SigningKey

    //     that was used to validate the signature.

    [DefaultValue(false)]

    public bool ValidateIssuerSigningKey { get; set; }