FEATURE: JWT signature verification about angular-jwt HOT 2 CLOSED

I think the principle is that the server needs to validate, and the client usually doesn't need to validate (trust the server). Validating would require sending the secret to the client, which would be bad. However, this library has the ability to decode and verify client-side: https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWT-verification

from angular-jwt.

I guess taking into account how the JWT-angular is meant to be used, I guess you are right, it's really not part of the library as client does not read and use any sensitive data thus no need to verify the token on the client side. It's up to the dev to realize that jwtHelper.decodeToken does NOT and verify the token and thus result cannot be trusted.

Yes, if the JWT is signed with a secret, I agree, client cannot contain the secret. In case the JWT is signed with a private key, it can be verified in the client side with the signers public key. For example when you implement OpenID Connect Implicit 1.0 flow (http://openid.net/specs/openid-connect-implicit-1_0.html) client needs to verify the callbacks id_token with servers public key. And yes, I used the https://github.com/kjur/jsrsasign for that.

from angular-jwt.