ID Token Validation Examples

Expected values for this issuer:

issuer = "http://auth.wardershield.com"

Python with python-jose:

from jose import jwt
import requests

issuer = "http://auth.wardershield.com"
client_id = "<your-client-id>"
id_token = "<id-token>"

jwks = requests.get(f"{issuer}/jwks.json").json()
key = jwks["keys"][0]
claims = jwt.decode(id_token, key, algorithms=[key["alg"]], audience=client_id, issuer=issuer)
print(claims)

Validation checklist:

1. Verify the JWT signature against /jwks.json
2. Check iss equals the issuer
3. Check aud contains your client_id
4. Check exp is in the future
5. If you sent nonce on /authorize, verify the same nonce is in the ID token