Cloud Native Data Security with OAuth

Chapter 6. Access Token Design

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 6th chapter of the final book. The GitHub repo is available at https://github.com/curityio/cloud-native-oauth-security-examples.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

We can’t emphasize enough the importance of the access token. That is why we focus on it for two consecutive chapters. In this chapter we talk about the token itself, how to design access tokens to best serve your APIs. In Chapter 7 we cover exposing access tokens to the outside world. We divided the content into two chapters so that you can reference it and get back to it more easily, but we think that you should study both chapters to understand the different aspects of the access token and how they impact your APIs’ security.

The access token is always related to a set of claims that your APIs use to make authorization decisions. The token can contain the claims as a payload or it can serve as a reference to them. Whatever your case, it is important that you understand how to design these claims — what information you should eventually associate with the token ...