I have set up Anthos Service Mesh user authentication using this guide: Anthos Service Mesh user authenthication

The idea behind this guide is deploy special service, which will perform OAuth 2.0 flow against OIDC server and create additional AuthorizatonPolicy rules for Istio, which will move all traffic to the service and execute necessary token validations.

According the guide, I have implemented next rule:

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: require-rc-token
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "authservice.asm-user-auth.svc.cluster.local"
    audiences:
    - "test_audience"
    jwksUri: "http://authservice.asm-user-auth.svc.cluster.local:10004/_gcp_user_auth/jwks"
    fromHeaders:
    - name: X-ASM-RCTOKEN
    forwardOriginalToken: true

This policy is validating token, which was created by authservice, and pass the request to an application if sign is correct.

I don’t have any additional checks and validations at my application. As far as I understand, the policy will be executed at Envoy. Hence, a request will be validated and my application can rely on the token (?). Should I validate signature at my backend again or I can skip this validation?

I expect that a token is valid and my backend doesn’t need to validate the token again.