CODEWITHSUNDEEP
authenticationoauth-2.0jwtauthorizationgoogle-oauth
uuu
uuu

Reputation: 51

Id tokens vs access tokens

Auth0 claim I should ALWAYS use an access token to secure an API.

If I have control over both my client app and my backend API - why is it wrong to validate the id token as my authorization for my API? Id tokens signed with asymmetric keys seems secure - I don't understand how this is less secure than an access token.

Upvotes: 5

Views: 1244

Answers (2)

Francisco Cardoso
Francisco Cardoso

Reputation: 1968

Access Tokens from Auth0 implement a Sender constraint principle, which makes tokens invalid when used by an attacker. The article you've mentioned might be a bit confusing, as it you might think they're talking about any Access Token, when they're actually talking specifically about theirs.

Keeping that in mind, most of other tokens will have the same security level, as long as they expire and can be refreshed. The difference is purpose/semantic, as mentioned in other responses.

Upvotes: 0

Hans Z.
Hans Z.

Reputation: 53928

It is not so much about security more more about usability and semantics. An id_token is supposed to represent an authentication event: it is short-lived and (primarily) designed to be one-time usage only, Those properties don't make it a good token for API usage.

Upvotes: 4

Related Questions