title: Token validation in WebApp WebApi Authentication using Azure AD?
body: <p>Working on WebApp &lt;=> WebApi Authentication scenario, where I get the JWT token from the Azure AD in the WebApp and pass the same to the WebApi. In the WebApi, generate a access token for Azure GraphAPI from the token from the WebApp to make calls to the GraphAPI for authorization.</p>
  
  <p>Both the WebApp and WebApi are registered as a single application on the Azure tenant portal, as the users authentication is same for both WebApp and WebApi.</p>
  
  <p>This is a intranet application and is open to all the users in AD. A couple of questions related to token validation or authentication.</p>
  
  <ol>
  <li>Do I need to verify the Tenant and the Audience in the token in both WebApp and WebApi?</li>
  <li>What other token validations do I need to perform in the WebApp, WebApi or in both?</li>
  </ol>
  
  <p>As JWT token is digitally signed and encrypted. What would be implications of not doing validations in the WebApi, when the token is passed from the WebApp?</p>
  
  <p>Please advise.</p>