var tvps = new TokenValidationParameters
{
// In this app, the TodoListClient and TodoListService
// are represented using the same Application Id - we use
// the Application Id to represent the audience, or the
// intended recipient of tokens.
ValidAudience = ConfigurationManager.AppSettings["ida:Audience"],
// In a real application, you might use issuer validation to
// verify that the user's organization (if applicable) has
// signed up for the app. Here, we'll just turn it off.
ValidateIssuer = false,
};
Is this actually secure? For a production app should we also be validating IssuerSigningKey as well? Or is that not necessary because the key is signed with a public/private key pair?