Cloud Native Data Security with OAuth

Chapter 6. Access Token Design

We can’t emphasize enough the importance of the access token. That is why we focus on it for two consecutive chapters. In this chapter, we talk about the token itself, and how to design access tokens to best serve your APIs. In Chapter 7, we cover exposing access tokens to the outside world. We divided the content into two chapters so that you can reference it and get back to it more easily, but we think that you should study both chapters to understand the different aspects of the access token and how they impact your API security.

The access token delivers a set of claims that your APIs use to make authorization decisions. The token can contain the claims as a payload or it can serve as a reference to them. In either case, it is important that you understand what information you will eventually associate with the access token and how your authorization server will retrieve that information during token issuance.

In this chapter, we focus on that design so that your access tokens allow your APIs to authorize requests correctly. We first explain how you use scopes to set security boundaries. We then focus on claims, the fundamental building block that enables fine-grained authorization. We briefly discuss the role of user consent when releasing claims in tokens. We then explain how to scale your access token design to many services with good manageability. Finally, we examine how sharing access tokens between APIs in a microservices architecture ...