I am using the predefined userflow and use the public key that AD B2C provides in jwks_uri to validate the token on my side. My question is whether that public key will be changed later?
1 Answers
Yes. As the official document states:
Azure AD B2C rotates the possible set of keys periodically. Your application should be written to handle those key changes automatically. A reasonable frequency to check for updates to the public keys used by Azure AD B2C is every 24 hours. To handle unexpected key changes, your application should be written to re-retrieve the public keys if it receives an unexpected kid value.
https://contoso.b2clogin.com/contoso.onmicrosoft.com/b2c_1_signupsignin1/discovery/v2.0/keys
The JSON document located at this URL contains all the public key information in use at a particular moment.
So the keys will be changed periodically and you should handle those key changes automatically by always getting the latest signing keys using the OpenID Connect discovery document.
Related