title: How to validate signature on the token on SPA using Azure and Django?
body: <p>I am trying to use Microsoft Outlook mail API in our web application.
  Followed this tutorial <a href="https://docs.microsoft.com/en-us/outlook/rest/javascript-tutorial" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/outlook/rest/javascript-tutorial</a> first, but some important thing is skipped in it.  </p>
  
  <hr>
  
  <p>[Skipped part]</p>
  
  <p><a href="https://docs.microsoft.com/en-us/outlook/rest/javascript-tutorial#using-the-id-token" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/outlook/rest/javascript-tutorial#using-the-id-token</a></p>
  
  <blockquote>
    <p>This sample won't do all of the required validations listed in the
    OpenID spec. Most notably, it won't validate the signature on the
    token. Currently requesting the signing keys from Azure would require
    a server-side component, so we'll skip that step for the sake of
    simplicity. However, production apps should not skip this important
    step!</p>
  </blockquote>
  
  <p>In the example code:</p>
  
  <pre><code>  // Per Azure docs (and OpenID spec), we MUST validate
    // the ID token before using it. However, full validation
    // of the signature currently requires a server-side component
    // to fetch the public signing keys from Azure. This sample will
    // skip that part (technically violating the OpenID spec) and do
    // minimal validation
  </code></pre>
  
  <hr>
  
  <p>I have a server-side component created with Django, but I'm not sure how to fetch the public signing keys from Azure.  </p>
  
  <p>The actual feature I am implementing is sending email via HTML form. I chose to implement this feature on client-side due to several reasons. It's working and I'd like to make authentication secure before deployment.</p>
  
  <p>Just clarify, I followed the tutorial above and use code from this <a href="https://github.com/jasonjoh/javascript-tutorial/tree/outlook-api" rel="nofollow noreferrer">repo</a>  to access Outlook API instead of Microsoft graph. The repo is introduced in the beginning of this tutorial.  </p>
  
  <p>Thank you in advance.</p>