#### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt')

## ValidationOptions Enum

Set of flags for specifying various validation options for JWT tokens\.
These options can be combined using bitwise operations to create a customized set of validation rules\.

```csharp
public enum ValidationOptions
```
### Fields

###### `RequireIssuer` 1 {#Abblix.Jwt.ValidationOptions.RequireIssuer}

Requires the issuer claim \(iss\) to be present in the JWT\.

###### `ValidateIssuer` 2 {#Abblix.Jwt.ValidationOptions.ValidateIssuer}

Validates the issuer of the JWT if present\.
Ensures that the issuer claim \(iss\) matches a specified value, typically configured in the token validation parameters\.

###### `RequireAudience` 4 {#Abblix.Jwt.ValidationOptions.RequireAudience}

Requires the audience claim \(aud\) to be present in the JWT\.

###### `ValidateAudience` 8 {#Abblix.Jwt.ValidationOptions.ValidateAudience}

Validates the audience of the JWT if present\.
Ensures that the audience claim \(aud\) matches one of the specified values, typically configured in the token validation parameters\.

###### `RequireSignedTokens` 16 {#Abblix.Jwt.ValidationOptions.RequireSignedTokens}

Rejects tokens issued with the unsecured "none" algorithm, ensuring that every accepted
token carries a signature or MAC\.

###### `ValidateIssuerSigningKey` 32 {#Abblix.Jwt.ValidationOptions.ValidateIssuerSigningKey}

Validates the signing key of the issuer\.
Ensures that the key used to sign the JWT is valid and is authorized by the issuer\.

###### `ValidateLifetime` 64 {#Abblix.Jwt.ValidationOptions.ValidateLifetime}

Validates the lifetime of the JWT\.
Ensures that the token is within its valid time frame of use \(not expired and not yet valid if the 'nbf' claim is specified\)\.

###### `UseEmbeddedVerificationKey` 128 {#Abblix.Jwt.ValidationOptions.UseEmbeddedVerificationKey}

Switches signature validation to the embedded\-key trust model: the signing key
is taken from the JOSE header's `jwk` parameter
\([VerificationKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.VerificationKey 'Abblix\.Jwt\.JsonWebTokenHeader\.VerificationKey')\) and the issuer\-resolved\-keys
delegate is bypassed entirely\. Set this flag only on validation paths whose
protocol design explicitly trusts the proof to carry its own key \(DPoP per
RFC 9449 §4\.2 is the canonical example\)\.

### Remarks
Auto\-trusting an embedded JWK without an opt\-in is a known JWT antipattern: an
attacker who controls the token header could substitute their own key\. The flag
is the explicit caller\-side declaration "I am validating a proof whose trust
model is embedded\-key, not issuer\-resolved\-key\." When the flag is set the JOSE
header MUST carry a valid `jwk` parameter; absence is an error\.

###### `RequireExpirationTime` 256 {#Abblix.Jwt.ValidationOptions.RequireExpirationTime}

Requires the token to carry an expiration time\. Pairs with [ValidateLifetime](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateLifetime 'Abblix\.Jwt\.ValidationOptions\.ValidateLifetime')
the way [RequireIssuer](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.RequireIssuer 'Abblix\.Jwt\.ValidationOptions\.RequireIssuer') pairs with [ValidateIssuer](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateIssuer 'Abblix\.Jwt\.ValidationOptions\.ValidateIssuer'): the Validate
flag checks a claim that is there, the Require flag says it has to be there\.

### Remarks
Without this, [ValidateLifetime](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateLifetime 'Abblix\.Jwt\.ValidationOptions\.ValidateLifetime') alone accepts a token carrying neither
`nbf` nor `exp` \- there is no instant at which such a token is expired, so
checking its lifetime finds nothing wrong\. That is right for the token types whose
specifications leave expiry out, and wrong for the ones that make it REQUIRED, which is
why the two are separate flags rather than one stricter check\.
Set it wherever the governing specification demands `exp`: an ID Token \(OpenID
Connect Core 1\.0 section 2, "REQUIRED"\), a JWT access token \(RFC 9068 section 2\.2,
"exp REQUIRED"\), a client assertion or JWT bearer grant \(RFC 7523 section 3, "The JWT
MUST contain an 'exp' claim"\)\. Leave it clear where the specification is silent, and
note that silence is not an oversight in at least one case: RFC 7592 section 5 says a
registration access token "SHOULD NOT expire while a client is still actively
registered", and this library issues those without an expiry accordingly\.
Deliberately absent from [Default](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.Default 'Abblix\.Jwt\.ValidationOptions\.Default'), because several call sites derive their
options from Default by subtraction and would inherit a requirement their tokens do not
meet \- including tokens this library itself mints\.

###### `RequireValidIssuer` 3 {#Abblix.Jwt.ValidationOptions.RequireValidIssuer}

Requires and validates the issuer claim \(iss\)\.
Combines RequireIssuer and ValidateIssuer flags\.

###### `RequireValidAudience` 12 {#Abblix.Jwt.ValidationOptions.RequireValidAudience}

Requires and validates the audience claim \(aud\)\.
Combines RequireAudience and ValidateAudience flags\.

###### `RequireValidSignedTokens` 48 {#Abblix.Jwt.ValidationOptions.RequireValidSignedTokens}

Requires and validates signed tokens\.
Combines RequireSignedTokens and ValidateIssuerSigningKey flags\.

###### `Default` 127 {#Abblix.Jwt.ValidationOptions.Default}

Default validation options that include validating the issuer, audience, presence of a signature,
validation of the issuer's signing key, and the token's lifetime\.
This is a common set of validations providing a standard level of security\.