lib/util/token-decoder.js
function doTokenValidation(token,publicKey,appId) {
	  var parts = token.split('.');
	  if (parts.length < 3) {
            ibmlogger.getLogger().debug("The token decode failure details:", token);
            return Q.reject(RejectionMessage("The token is malformed.", token,RejectionMessage.INVALID_TOKEN_ERROR));
	  }
		    
	  if (parts[2].trim() === '' && publicKey) {
		  return Q.reject(RejectionMessage("The token missing the signature.", token,RejectionMessage.INVALID_TOKEN_ERROR));
	  }

	  var valid;
	  if (publicKey) {
		  try {
		    valid = jws.verify(token, publicKey);
			if (!valid) {
				return Q.reject(RejectionMessage("The token was verified failed with the public key.", token,RejectionMessage.INVALID_TOKEN_ERROR));
			}
		  }
		  catch (e) {
			return Q.reject(RejectionMessage("An error occurred when verifying the token"+e.message, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  
	  var decodedToken = jws.decode(token,{json:true});
	  if (!decodedToken) {
		  return Q.reject(RejectionMessage("The token was decoded failed", token, RejectionMessage.INVALID_TOKEN_ERROR));
	  }
	  
	  var payload = decodedToken.payload;
	  
	  if (payload.exp) {
		  if (Math.round(Date.now()) / 1000 >= payload.exp) {
			  return Q.reject(RejectionMessage("The token has been expired.", token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  
	  if (payload.aud) {
		  if (payload.aud != appId) {
			  return Q.reject(RejectionMessage("The aud in token is inconsistent with the given application id."+payload.aud+","+appId, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  /*
	  if (options.audience) {
		  if (payload.aud !== options.audience) {
			  return Q.reject(RejectionMessage("The audience is different from the expected aud:"+options.audience, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }

	  if (options.issuer) {
		    if (payload.iss !== options.issuer) {
		    	return Q.reject(RejectionMessage("The issuer is different from the expected iss:"+options.issuer, token, RejectionMessage.INVALID_TOKEN_ERROR));
		    }
	  }
	  */
	  return Q.resolve(payload);
}
function doTokenValidation(token,publicKey,appId) {
	  var parts = token.split('.');
	  if (parts.length < 3) {
            ibmlogger.getLogger().debug("The token decode failure details:", token);
            return Q.reject(RejectionMessage("The token is malformed.", token,RejectionMessage.INVALID_TOKEN_ERROR));
	  }
		    
	  if (parts[2].trim() === '' && publicKey) {
		  return Q.reject(RejectionMessage("The token missing the signature.", token,RejectionMessage.INVALID_TOKEN_ERROR));
	  }

	  var valid;
	  if (publicKey) {
		  try {
		    valid = jws.verify(token, publicKey);
			if (!valid) {
				return Q.reject(RejectionMessage("The token was verified failed with the public key.", token,RejectionMessage.INVALID_TOKEN_ERROR));
			}
		  }
		  catch (e) {
			return Q.reject(RejectionMessage("An error occurred when verifying the token"+e.message, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  
	  var decodedToken = jws.decode(token,{json:true});
	  if (!decodedToken) {
		  return Q.reject(RejectionMessage("The token was decoded failed", token, RejectionMessage.INVALID_TOKEN_ERROR));
	  }
	  
	  var payload = decodedToken.payload;
	  
	  if (payload.exp) {
		  if (Math.round(Date.now()) / 1000 >= payload.exp) {
			  return Q.reject(RejectionMessage("The token has been expired.", token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  
	  if (payload.aud) {
		  if (payload.aud != appId) {
			  return Q.reject(RejectionMessage("The aud in token is inconsistent with the given application id."+payload.aud+","+appId, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }
	  /*
	  if (options.audience) {
		  if (payload.aud !== options.audience) {
			  return Q.reject(RejectionMessage("The audience is different from the expected aud:"+options.audience, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }

	  if (options.issuer) {
		    if (payload.iss !== options.issuer) {
		    	return Q.reject(RejectionMessage("The issuer is different from the expected iss:"+options.issuer, token, RejectionMessage.INVALID_TOKEN_ERROR));
		    }
	  }
	  */
	  return Q.resolve(payload);
}
function doTokenValidation ( token , publicKey , appId ) { var parts = token . split ( '.' ) ; if ( parts . length < 3 ) { ibmlogger . getLogger ( ) . debug ( "The token decode failure details:" , token ) ; return Q . reject ( RejectionMessage ( "The token is malformed." , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } if ( parts [ 2 ] . trim ( ) === '' && publicKey ) { return Q . reject ( RejectionMessage ( "The token missing the signature." , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } var valid ; if ( publicKey ) { try { valid = jws . verify ( token , publicKey ) ; if ( ! valid ) { return Q . reject ( RejectionMessage ( "The token was verified failed with the public key." , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } } catch ( e ) { return Q . reject ( RejectionMessage ( "An error occurred when verifying the token" + e . message , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } } var decodedToken = jws . decode ( token , { json : true } ) ; if ( ! decodedToken ) { return Q . reject ( RejectionMessage ( "The token was decoded failed" , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } var payload = decodedToken . payload ; if ( payload . exp ) { if ( Math . round ( Date . now ( ) ) / 1000 >= payload . exp ) { return Q . reject ( RejectionMessage ( "The token has been expired." , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } } if ( payload . aud ) { if ( payload . aud != appId ) { return Q . reject ( RejectionMessage ( "The aud in token is inconsistent with the given application id." + payload . aud + "," + appId , token , RejectionMessage . INVALID_TOKEN_ERROR ) ) ; } } /*
	  if (options.audience) {
		  if (payload.aud !== options.audience) {
			  return Q.reject(RejectionMessage("The audience is different from the expected aud:"+options.audience, token, RejectionMessage.INVALID_TOKEN_ERROR));
		  }
	  }

	  if (options.issuer) {
		    if (payload.iss !== options.issuer) {
		    	return Q.reject(RejectionMessage("The issuer is different from the expected iss:"+options.issuer, token, RejectionMessage.INVALID_TOKEN_ERROR));
		    }
	  }
	  */ return Q . resolve ( payload ) ; }
Verify the token with the public key.
And validate the exp, iss and aud with the decoded token.
Verify the token with the public key . And validate the exp iss and aud with the decoded token .