okta.github.io/code/php/jwt-validation.html at master · alexcodebr/okta.github.io

627 lines (347 loc) · 27.3 KB
<!doctype html>
<html class="no-js" lang="en" dir="ltr">
    var searchDomain = 'https://developer.okta.com';
    var isProduction = window.location.hostname === 'developer.okta.com';
    if (isProduction) {
      // TypeKit
      (function(d) {
        var config = {
          kitId: 'jff5neq',
          scriptTimeout: 3000,
          async: true
        h=d.documentElement,t=setTimeout(function(){h.className=h.className.replace(/bwf-loadingb/g,"")+" wf-inactive";},config.scriptTimeout),tk=d.createElement("script"),f=false,s=d.getElementsByTagName("script")[0],a;h.className+=" wf-loading";tk.src='https://use.typekit.net/'+config.kitId+'.js';tk.async=true;tk.onload=tk.onreadystatechange=function(){a=this.readyState;if(f||a&&a!="complete"&&a!="loaded")return;f=true;clearTimeout(t);try{Typekit.load(config)}catch(e){}};s.parentNode.insertBefore(tk,s)
      })(document);
      // Google analytics
      (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
              (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
              m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
      })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
      ga('create', 'UA-15777010-3', 'auto');
      ga('send', 'pageview');
      // START Google Tag Manager
      (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
      new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
      j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
      '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
      })(window,document,'script','dataLayer','GTM-TJ45R6');
      // END Google Tag Manager
  <meta charset="utf-8">
  <meta http-equiv="x-ua-compatible" content="IE=edge,chrome=1">
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link type="text/css" rel="stylesheet" href="https://developer.okta.com/sites/all/themes/developer/css/master.css" media="all" />
  <meta class="swiftype" name="title" data-type="string" content="PHP | Okta Developer" />
  <meta class="swiftype" name="summary" data-type="string" content="How to validate Okta JWTs with PHP." />
  <link type="text/css" rel="stylesheet" href="/assets/animate-ec43d72c3ed45e08a460b8a2966d8dba6006aebfa0530935c3973fa493a8771f.css">
  <link type="text/css" rel="stylesheet" href="/assets/okta-e0a2f1567b2617a1ac64c3cfe8f94086456f3fb4e1a8ae52fe18398b4ad2ee3f.css">
  <link rel="shortcut icon" type="image/vnd.microsoft.icon" href="/favicon.ico">
  <title>PHP | Okta Developer</title>
  <meta name="description" content="How to validate Okta JWTs with PHP.">
  <link rel="canonical" href="https://developer.okta.com/code/php/jwt-validation">
  <link rel="alternate" type="application/rss+xml" title="Okta Developer" href="https://developer.okta.com/feed.xml"><!-- GA -->
  <div class="Page Page--docs-page">
    <!-- START Header -->
<header class="Header is-fixed">
  <div class="Wrap">
    <a class="Logo" href="https://developer.okta.com">
      <svg version="1.1" id="OktaLogo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 431.9 151.4" style="enable-background:new 0 0 431.9 151.4;" xml:space="preserve"><g><g><g><path d="M102.2,41.4c-21,0-38.1,17.1-38.1,38.1s17.1,38.1,38.1,38.1s38.1-17.1,38.1-38.1l0,0C140.3,58.5,123.2,41.4,102.2,41.4z M102.2,98.5c-10.5,0-19-8.5-19-19s8.5-19,19-19s19,8.5,19,19c0.1,10.5-8.4,19-18.9,19.1C102.3,98.6,102.2,98.6,102.2,98.5L102.2,98.5z"/><path d="M169.1,92.3c0-1.9,1.5-3.4,3.4-3.4c0.9,0,1.8,0.4,2.4,1c9.5,9.7,25.3,26.3,25.4,26.4c0.4,0.5,0.8,0.8,1.4,0.9l1.6,0.2h17.2c1.8,0,3.3-1.4,3.4-3.2c0-0.8-0.3-1.5-0.8-2.2l-28.6-29.2l-1.5-1.5c-3.2-3.9-2.9-5.4,0.8-9.3l22.6-25.1c1.1-1.4,0.8-3.5-0.6-4.6c-0.6-0.4-1.3-0.7-2-0.7h-17c-0.6,0.2-1.1,0.5-1.5,0.9L175,64.4c-1.3,1.4-3.4,1.5-4.8,0.2c-0.7-0.6-1.1-1.5-1.1-2.5V18.9c0-1.7-1.3-3-3-3c-0.1,0-0.2,0-0.3,0h-12.7c-2.2,0-3.3,1.5-3.3,2.8v95.8c0,2.2,1.8,2.8,3.3,2.8h12.7c1.7,0.1,3.2-1.2,3.3-2.9c0,0,0,0,0,0V92.3z"/><path d="M273,114l-1.4-12.8c-0.2-1.7-1.7-2.9-3.4-2.7c0,0,0,0-0.1,0l-2.9,0.2c-10.1,0-18.5-7.9-19-18c0-0.3,0-0.7,0-1V64.2c-0.1-2,1.5-3.6,3.5-3.7c0,0,0,0,0,0h17c1.7-0.1,3.1-1.5,3-3.2c0,0,0-0.1,0-0.1v-12c0-2.3-1.5-3.6-2.8-3.6h-17.1c-1.9,0.1-3.5-1.5-3.6-3.4c0,0,0,0,0,0V18.9c-0.1-1.7-1.5-3.1-3.2-3c0,0-0.1,0-0.1,0h-12.7c-1.6-0.1-3,1.1-3.1,2.7c0,0.1,0,0.1,0,0.2c0,0,0,61.7,0,62c0.5,21,17.9,37.6,38.9,37c1.4,0,2.9-0.2,4.3-0.3C272,117.2,273.2,115.7,273,114z"/></g><path d="M364.7,98c-10.8,0-12.4-3.8-12.4-18.3l0,0V44.8c0-1.8-1.4-3.2-3.2-3.2c0,0-0.1,0-0.1,0h-12.8c-1.8,0-3.2,1.4-3.3,3.2v1.6C314.6,36,291.3,42.5,281,60.8c-10.4,18.3-3.9,41.6,14.4,51.9c14,7.9,31.4,6.2,43.5-4.2c3.6,5.5,9.3,9.1,18.3,9.1c1.5,0,9.7,0.3,9.7-3.5v-13.6C367,99.2,366,98.1,364.7,98z M314.2,98.6c-10.5,0-19-8.5-19-19s8.5-19,19-19s19,8.5,19,19l0,0C333.2,90.1,324.7,98.6,314.2,98.6z"/></g><path d="M19.4,74c2.2-1.9,4.1-4.1,5.7-6.6c3.5-5.3,5.4-11.5,5.2-17.9V27c0-4.9,0.9-8.4,2.7-10.5c1.8-2.1,4.8-3,9.2-3h12.6c1.2,0,2.1-0.9,2.2-2.1l0,0V2.2C57,1,56,0,54.8,0c0,0,0,0,0,0H41.5c-7.8,0-12.9,2.1-18,7.6s-7.1,12.3-7.1,21.7v14.2c0,2.2-0.1,4-0.2,5.7v2.2c-0.5,3.2-1.8,6.2-3.6,8.9C9.4,64.7,5.1,70.9,0.9,74l0,0l-0.3,0.3l0,0l-0.2,0.3H0.2v0.3l0,0c-0.1,0.3-0.1,0.7,0,1l0,0v0.3h0.1l0.2,0.3l0,0l0.3,0.3l0,0c4.2,3.1,8.5,9.3,11.3,13.7c1.8,2.7,3.1,5.7,3.6,8.9v2.2c0.1,1.6,0.2,3.5,0.2,5.7v14.3c0,9.4,2.4,16.7,7.1,21.7s10.2,7.6,18,7.6h13.8c1.2,0,2.2-1,2.2-2.2V140l0,0c0-1.2-1-2.2-2.2-2.2H42.2c-4.4,0-7.5-1-9.2-3s-2.7-5.6-2.7-10.5v-22.4c0.2-6.4-1.7-12.6-5.2-17.9c-1.6-2.5-3.5-4.7-5.7-6.6l0,0c-0.9-0.7-1.1-2-0.4-2.9C19.2,74.3,19.3,74.2,19.4,74L19.4,74z"/><path d="M412.5,74c-2.2-1.9-4.1-4.1-5.7-6.6c-3.5-5.3-5.4-11.5-5.2-17.9V27c0-4.9-0.9-8.4-2.7-10.5s-4.8-3-9.2-3h-12.6c-1.2,0-2.2-1-2.2-2.2c0,0,0,0,0,0l0,0V2.2c0-1.2,1-2.2,2.2-2.2c0,0,0,0,0,0h13.4c7.8,0,12.9,2.1,18,7.6s7.1,12.3,7.1,21.7v14.2c0,2.2,0.1,4,0.2,5.7v2.2c0.5,3.2,1.8,6.2,3.6,8.9c2.8,4.5,7.1,10.7,11.3,13.7l0,0l0.3,0.3l0,0l0.2,0.3h0.1v0.3l0,0c0.1,0.3,0.1,0.7,0,1l0,0v0.3h-0.1l-0.2,0.3l0,0l-0.3,0.3l0,0c-4.2,3.1-8.5,9.3-11.3,13.7c-1.8,2.7-3.1,5.7-3.6,8.9v2.2c-0.1,1.6-0.2,3.5-0.2,5.7v14.3c0,9.4-2.4,16.7-7.1,21.7s-10.2,7.6-18,7.6h-13.4c-1.2,0-2.2-1-2.2-2.2c0,0,0,0,0,0V140l0,0c0-1.2,1-2.2,2.2-2.2l0,0h12.7c4.4,0,7.5-1,9.2-3s2.7-5.6,2.7-10.5v-22.4c-0.2-6.3,1.6-12.6,5.1-17.9c1.6-2.5,3.5-4.7,5.7-6.6l0,0c0.9-0.7,1.1-2,0.4-2.9C412.7,74.3,412.6,74.2,412.5,74L412.5,74z"/></g></svg>
    <nav class="Header-nav PrimaryNav">
      <ul class="menu">
        <li class="first leaf">
          <a href="https://developer.okta.com/product/">Product</a>
        </li>
        <li class="leaf">
          <a href="https://developer.okta.com/pricing/">Pricing</a>
        </li>
        <li class="leaf">
          <a href="/blog/">Blog</a>
        </li>
        <li class="leaf">
          <a href="/documentation/" class="active">Docs</a>
        </li>
        <li class="last expanded">
          <span class="nolink">Support</span>
          <ul class="menu">
            <li class="first leaf"><a href="https://devforum.okta.com/">Okta Developer Forums</a></li>
            <li class="last leaf"><a href="mailto:developers@okta.com">developers@okta.com</a></li>
          </ul>
        </li>
      </ul>
      <a class="PrimaryNav-toggle" href="#">
        <svg width="20px" height="20px" viewBox="0 0 20 20" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
            <g class="MenuIcon" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd" stroke-linecap="round">
                <path d="M1,16 L19,16" class="MenuIcon-line1" stroke="#FFFFFF" stroke-width="2"></path>
                <path d="M1,4 L19,4" class="MenuIcon-line2" stroke="#FFFFFF" stroke-width="2"></path>
                <path d="M1,10 L19,10" class="MenuIcon-line3" stroke="#FFFFFF" stroke-width="2"></path>
                <path d="M1,10 L19,10" class="MenuIcon-line4" stroke="#FFFFFF" stroke-width="2"></path>
            </g>
        </svg>
        <svg class="CloseIcon" width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
          <g id="ALl-Boards" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
            <g id="Desktop" transform="translate(-915.000000, -235.000000)" fill="#FFFFFF">
              <g id="Search-bar-Active" transform="translate(30.000000, 26.000000)">
                <polygon id="Icon/Cross" points="901 210.6 899.4 209 893 215.4 886.6 209 885 210.6 891.4 217 885 223.4 886.6 225 893 218.6 899.4 225 901 223.4 894.6 217"></polygon>
              </g>
            </g>
          </g>
        </svg>
      <div class="PrimaryNav-cta">
        <a href="https://developer.okta.com/signup/" class="Button--red">Sign up</a>
      </div>
      <a class="SearchIcon" href="#"></a>
      <form id="form_search" class="SearchBar Formisimo_clocked_69929" method="get" action="https://developer.okta.com/search/" name="form_search" __bizdiag="-784164280" __biza="WJ__">
        <input type="text" name="stq" autocomplete="off" id="st-search-input-auto" class="st-search-input" placeholder="Search">
        <input type="submit" name="submit" value="GO">
      </form>
    <!-- END Header -->
    <!-- START Page Center w/Sub Nav & Content -->
    <section class="PageContent DynamicSidebar has-tableOfContents">
      <!-- START Fixed sidebar -->
      <aside class="Sidebar">
        <h2 class="Sidebar-location Sidebar-toggle h6">Navigation</h2>
        <div class="Sidebar-close Sidebar-toggle"></div>
        <div>
          <h3 class="Sidebar-title">Client Integrations</h3>
          <ul class="Sidebar-nav">
              <li >
                <a href="/code/angular/">ANGULAR</a>
              </li>
              <li >
                <a href="/code/ios/">IOS</a>
              </li>
              <li >
                <a href="/code/javascript/">JAVASCRIPT</a>
              </li>
              <li >
                <a href="/code/react/">REACT</a>
              </li>
          </ul>
          <h3 class="Sidebar-title">Server Integrations</h3>
          <ul class="Sidebar-nav">
              <li >
                <a href="/code/dotnet/">.NET</a>
              </li>
              <li >
                <a href="/code/java/">JAVA</a>
              </li>
              <li >
                <a href="/code/nodejs/">NODE.JS</a>
              </li>
              <li class="is-active">
                <a href="/code/php/">PHP</a>
              </li>
              <li >
                <a href="/code/python/">PYTHON</a>
              </li>
          </ul>
        </div>
      </aside>
      <!-- END Fixed sidebar -->
      <!-- START Page Content -->
      <div class="PageContent-main">
        <h1 id="overview">Overview</h1>
<p>As a result of a successful authentication by <a href="/docs/api/resources/oauth2.html#obtain-an-authorization-grant-from-a-user">obtaining an authorization grant from a user</a> 
or using the Okta API, you will be provided with a signed JWT (<code class="highlighter-rouge">id_token</code> and/or <code class="highlighter-rouge">access_token</code>). A common use case for 
these access tokens is to use it inside of the Bearer authentication header to let your application know who the user
is that is making the request. In order for you to know this use is valid, you will need to know how to validate the
token against Okta. This guide gives you an example of how to do this using common libraries in PHP for working 
with JWTs. These steps can be adapted for most JWT libraries that you may want to use.</p>
<h2 id="things-you-will-need">Things you will need</h2>
<p>For validating a JWT, you will need a few different items:</p>
  <li>Your issuer URL</li>
  <li>The JWT string you want to verify</li>
  <li>A JWT library, this guide will use <a href="https://packagist.org/packages/firebase/php-jwt">firebase/php-jwt</a></li>
  <li>A package to convert a JWK to a public key.</li>
<h2 id="working-with-authorization-server-keys">Working with Authorization Server Keys</h2>
<p>The first thing you will need to do is make a request to get your current keys for your authorization server. The URL for the keys can be discovered by visiting the .well-known endpoint of your authorization server. The .well-known 
endpoint is listed in your authorization server dashboard and looks like 
<code class="highlighter-rouge">https://{yourOktaDomain}.com/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server</code></p>
<p>Once you have your .well-known URL, have your application make a request to this endpoint and <code class="highlighter-rouge">json_decode</code> the results.</p>
<div class="language-php highlighter-rouge"><pre class="highlight"><code>$keys = json_decode(file_get_contents('https://{yourOktaDomain}/oauth2/{authorizationServerId}/v1/keys'));
</code></pre>
<p>This will return a JSON object of any keys. Typically, this will return a single key entry, but can return a set of keys.</p>
<h3 id="caching-keys">Caching Keys</h3>
<p>To avoid any future requests to the keys endpoint, you should cache the keys you receive in response to this 
request. As a guideline, store each key that is returned with the a combination of your Authorization Server id and the <code class="highlighter-rouge">kid</code>, or just the <code class="highlighter-rouge">kid</code> as the lookup key in your cache.</p>
<div class="language-php highlighter-rouge"><pre class="highlight"><code>foreach($keys as $key) {
$item = $this-&gt;cache-&gt;getItem($serverId . '-' . $kid);
if(!$item-&gt;isHit()) {
    $item-&gt;set($key);
    $this-&gt;cache-&gt;save($item);
</code></pre>
<blockquote>
  <p>Note: If you are not setting TTL for the cache entry, you should make sure to empty out old keys when new ones are added to the cache.</p>
</blockquote>
<p>This will allow you to look up the key for a later step. You could also update this to include a TTL if you wanted to make sure you request a fresh set of keys after a set amount of time, but this is not required.</p>
<h2 id="validating-a-jwt">Validating a JWT</h2>
<p>After you have your <code class="highlighter-rouge">access_token</code> from a successful login, or from the <code class="highlighter-rouge">Bearer token</code> in the authorization header, you will need to make sure that this is still valid. There are a few steps here to fully validate it.</p>
<h3 id="parsing-keys">Parsing Keys</h3>
<p>The keys you have stored in cache, or retrieved from the Authorization Server, need to be converted to an OpenSSL key resource that you can use. This can be done in any way you would like. There are some great libraries <a href="https://packagist.org/search/?q=jwk">on packagist</a> that can be used for this. Once you have the public key set, you are ready to continue validating the JWT.</p>
<div class="language-php highlighter-rouge"><pre class="highlight"><code>$keys = JWK::parseKeySet($authorizationServer-&gt;getKeys());
</code></pre>
<blockquote>
  <p><code class="highlighter-rouge">$authorizationServer</code> would be a class that gives you access to a method that gets the keys either from cache if they exist already, or makes a request to the keys server. <code class="highlighter-rouge">parseKeySet</code> is a function that can turn each key from the authorization server into a public key resource.</p>
</blockquote>
<h3 id="decode-a-jwt">Decode a JWT</h3>
<p>The JWT will then need to be decoded. In the <a href="https://packagist.org/packages/firebase/php-jwt">Firebase PHP-JWT</a> library, this is a method that accepts the <code class="highlighter-rouge">jwt</code>, <code class="highlighter-rouge">key</code>, and <code class="highlighter-rouge">allowed_algorithms</code>.</p>
<div class="language-php highlighter-rouge"><pre class="highlight"><code>$decoded = \Firebase\JWT\JWT::decode($jwt, $keys, ['RS256']);
</code></pre>
<p>If the key does not exist in the set of keys you pass, an exception will be thrown letting you know this. At this point, you can:</p>
  <li>Call the token invalid</li>
  <li>Go check for any new keys first, then validate again</li>
  <li>Fail validation</li>
<h4 id="alternate-decode-to-get-kid">Alternate decode to get kid</h4>
<p>You can also decode the JWT without key validation to get the headers of the JWT itself. The value of doing this allows you to get the <code class="highlighter-rouge">kid</code> out of the JWT header. This will allow you to see if the key was cached based on the <code class="highlighter-rouge">kid</code> from the header, and then decode fully with only passing the single key.</p>
<h3 id="verifying-jwt-claims">Verifying JWT Claims</h3>
<p>There are two different types of JWTs that you may need to verify, and each has its own set of claims to look at as well as some common ones. Use the table below as a guide of what element in the <code class="highlighter-rouge">access_token</code> or <code class="highlighter-rouge">idToken</code> corresponds to what you should verify it against.</p>
      <th> </th>
      <th>access_token</th>
      <th>id_token</th>
      <th>Compare With</th>
      <th>Description</th>
      <td>Issuer</td>
      <td><code class="highlighter-rouge">iss</code></td>
      <td><code class="highlighter-rouge">iss</code></td>
      <td>Issuer URI</td>
      <td>Who issued this token. This will be your Authorization Server URI</td>
      <td>Client ID</td>
      <td><code class="highlighter-rouge">cid</code></td>
      <td><code class="highlighter-rouge">aud</code></td>
      <td>ClientID</td>
      <td>The Client ID of the Application</td>
      <td>Issued At</td>
      <td><code class="highlighter-rouge">iat</code></td>
      <td><code class="highlighter-rouge">iat</code></td>
      <td>time()+300</td>
      <td>Verify that this claim is valid by checking that the token was not issued in the future, with some leeway for clock skew.</td>
      <td>Expired At</td>
      <td><code class="highlighter-rouge">exp</code></td>
      <td><code class="highlighter-rouge">exp</code></td>
      <td>time()-300</td>
      <td>Verify that this claim is valid by checking that the token has not expired, with some leeway for clock skew.</td>
<blockquote>
  <p>To make sure all machines are able to test this, we set the leeway to 5 minutes. In our research, 5 minutes was 
enough time to prevent most issues in regards to expire time and issued at time.</p>
</blockquote>
<h4 id="verify-nonce-only-when-verifying-id_token">Verify nonce (only when verifying id_token)</h4>
<p>To mitigate replay attacks, verify that the <code class="highlighter-rouge">nonce</code> value in the <code class="highlighter-rouge">id_token</code> matches the <code class="highlighter-rouge">nonce</code> that was used when doing the code exchange. This verification is optional, but is highly suggested to verify after the initial code exchange.</p>
<div class="language-php highlighter-rouge"><pre class="highlight"><code>if($decoded-&gt;claims['nonce'] != $request-&gt;getCookieParam('okta-oauth-nonce')) {
    throw new \Exception('Invalid Token: Nonce does not match.')
</code></pre>
<h2 id="conclusion">Conclusion</h2>
<p>The above are the basic steps for verifying an access token locally. The steps are not tied directly to a library, and can be applied to any JWT library you decide to use. We suggest you use either <a href="https://packagist.org/packages/firebase/php-jwt">firebase/php-jwt</a> or <a href="https://packagist.org/packages/spomky-labs/jose">spomky-labs/jose</a> as they have great support for this validation.</p>
      </div>
      <!-- END Page Content -->
    </section>
    <!-- END Page Center w/Sub Nav & Content -->
    <!-- START Footer -->
    <footer class="Footer">
    <div class="Wrap">
        <div class="Row">
            <div class="Column--3 Column--medium-6 Column--xSmall-12">
                <a class="Logo" href="https://www.okta.com/" target="_blank" rel="noopener noreferrer">
                    <img src="https://developer.okta.com/sites/all/themes/developer/images/logo-footer.png" alt="Okta">
                    Visit okta.com
            </div>
            <div class="Column--3 Column--medium-12 Column--xSmall-12">
                <h4>Social</h4>
                <ul class="Footer-links Footer-links--social">
                    <li><a class="Footer-links--github" target="_blank" rel="noopener noreferrer" href="http://github.com/oktadeveloper">Github</a></li>
                    <li><a class="Footer-links--twitter" target="_blank" rel="noopener noreferrer" href="http://twitter.com/OktaDev">Twitter</a></li>
                    <li><a class="Footer-links--forum" target="_blank" rel="noopener noreferrer" href="https://devforum.okta.com/">Forum</a></li>
                    <li><a class="Footer-links--rss" target="_blank" rel="noopener noreferrer" href="http://feeds.feedburner.com/OktaBlog">RSS Blog</a></li>
                </ul>
            </div>
            <div class="Column--3 Column--medium-6 Column--small-12">
                <h4>More Info</h4>
                <ul class="Footer-links">
                    <li><a target="_blank" href="https://developer.okta.com/integrate-with-okta/">Integrate with Okta</a></li>
                    <li><a href="/blog/">Blog</a></li>
                    <li><a href="/docs/platform-release-notes/platform-release-notes.html">Release Notes</a></li>
                    <li><a href="/3rd_party_notices/">3rd Party Notices</a></li>
                </ul>
            </div>
            <div class="Column--3 Column--medium-6 Column--small-12">
                <h4>Contact &amp; Legal</h4>
                <ul class="Footer-links">
                    <li><a href="/contact/">Contact Sales</a></li>
                    <li><a target="_blank" rel="noopener noreferrer" href="mailto:developers@okta.com">Contact Support</a></li>
                    <li><a href="/terms/">Terms &amp; Conditions</a></li>
                    <li><a href="/privacy/">Privacy Policy</a></li>
                </ul>
            </div>
        </div>
    <script type="text/javascript" src="/assets/master-0365dd27cf276cb2a15c0a43906ca592538204cf1ad4557547bf4e50609b411e.js"></script>
    <script type="text/javascript" src="/assets/quickstart-26919e2a466e6346d96282973427a3998da81637fd2a2ceb6917a61da7eaf2a8.js"></script>
    <script type="text/javascript" src="/assets/docsIndex-aebe0e7212e0f2974ef463f06967cba7144f5eed4f14bb11c346866f3fd4ecb7.js"></script>    
    <!-- END Footer -->
  <!-- START Post Footer -->
  <!-- START Google Tag Manager -->
  <!-- https://support.google.com/tagmanager/answer/6103696?hl=en -->
  <noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-TJ45R6" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
  <!-- END Google Tag Manager -->
  <!-- START Google Remarketing Tag -->
  <script type="text/javascript">
    /* <![CDATA[ */
    var google_conversion_id = 1006913831;
    var google_custom_params = window.google_tag_params;
    var google_remarketing_only = true;
    /* ]]> */
  </script>
  <div style="display:none;"><script type="text/javascript" src="//www.googleadservices.com/pagead/conversion.js"></script></div>
  <noscript><div style="display:inline;"><img height="1" width="1" style="border-style:none;" alt="" src="//googleads.g.doubleclick.net/pagead/viewthroughconversion/1006913831/?value=0&amp;guid=ON&amp;script=0"></div></noscript>
  <!-- END Google Remarketing Tag -->
  <!-- START Crazy Egg Tracking -->
  <script type="text/javascript">
    setTimeout(function(){var a=document.createElement("script");
    var b=document.getElementsByTagName("script")[0];
    a.src=document.location.protocol+"//script.crazyegg.com/pages/scripts/0021/9333.js?"+Math.floor(new Date().getTime()/3600000);
    a.async=true;a.type="text/javascript";b.parentNode.insertBefore(a,b)}, 1);
  </script>
  <!-- END Crazy Egg Tracking -->
  <!-- END Post Footer -->
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

jwt-validation.html

Latest commit

History

jwt-validation.html

File metadata and controls
