CODEWITHSUNDEEP
javaoauthjwtspring-cloudspring-security-oauth2
Ole
Ole

Reputation: 47090

Checking the validity of access tokens without round tripping to the authorization server?

With oauth access token validity has to be checked by the authorization server. Is there a way to do this without making a round trip to the authorization server for every request to the resource server? I've done some reading up on JWT and it seems like the since the JWT can be signed it should be able to be verified by the resource server without going to the authorization server? IIUC is there some standard / simple way to do this with spring security oauth?

Upvotes: 0

Views: 395

Answers (1)

tsolakp
tsolakp

Reputation: 5948

JWT does not require a call back to authorization server. You can either use:

1) Client secret key to sign and validate the JWT token. The secret key will be stored in both authorization server and your app.

2) Or preferrably use private/public keys like JWK to sign and validate the token. The private key will be stored on authorization server side and public token in your app. You can optionally get public key from authorization server, cache it and refresh after some period of time. For more see https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/store/jwk/JwkTokenStore.java.

Upvotes: 1

Related Questions