Does Edge Function JWT Verification assure valid token?

[skiunke]

By default, Edge Functions require a JWT Token to invoke a function. Does this have to be a JWT token issued by Supabase or any valid JWT token?

I'm asking this, because I use custom claims in JWT token and check the user_role in the token. I do not verify the token in any other way and just read the user_role.

If supabase would not verify the token anyone could temper a token with any user_role and exploit the edge function. Does supabase do this automatically or do I need to call the following code as stated in the documentation to retrieve a session?

  const supabaseClient = createClient(
    Deno.env.get('SUPABASE_URL') ?? '',
    Deno.env.get('SUPABASE_ANON_KEY') ?? '',
    { global: { headers: { Authorization: authHeader } } }
  )

[GaryAustin1]

If the jwt option is on, the edge function validates there is a jwt signed by your jwt secret.