CODEWITHSUNDEEP
phpvalidationoauthzend-framework2
Waqar Haider
Waqar Haider

Reputation: 973

OAuth 2.0. How the servers will validate access_tokens

I have two servers, let's say A and B. Server A will authenticate users and generate tokens. Now on server B how do I check if the token is valid? Do I have to go through server A every time to check for valid tokens?

Do I have to save the token along with the expiration date in Server B, and check for validation on Server B?

Upvotes: 0

Views: 139

Answers (1)

Takahiko Kawasaki
Takahiko Kawasaki

Reputation: 19011

If a server which issues access tokens (an authorization server) and a server which provides APIs protected by access tokens (a resource server) are different, in a simple implementation, the resource server has to communicate with the authorization server every time it validates an access token.

RFC 7662 (OAuth 2.0 Token Introspection) defines the specification of introspection endpoint which an authorization server provides for resource servers to introspect access tokens. Implementation of APIs hosted by resource servers are expected to call the introspection endpoint to validate access tokens presented by client applications.

Upvotes: 1

Related Questions