Contents
Is it OK to pass on OAuth access token between services?
It is ok to pass the token as you dont want user to log in again for another service call. Also, it depends on the way you have services setup. If service A needs some data from service B to provide data back to the user then we should pass the same user token.
Which is an example of an OAuth 2.0 flow?
For example, an application can use OAuth 2.0 to obtain permission from users to store files in their Google Drives. This OAuth 2.0 flow is called the implicit grant flow. It is designed for applications that access APIs only while the user is present at the application. These applications are not able to store confidential information.
Where to find client ID for OAuth 2.0?
Generate a URL to request access from Google’s OAuth 2.0 endpoint at https://accounts.google.com/o/oauth2/v2/auth. This endpoint is accessible over HTTPS; plain HTTP connections are refused. The client ID for your application. You can find this value in the API Console Credentials page.
Can a single access token be used against all APIs?
One key question we explore in this blog post series is: Should the application obtain a single access token that is used against all APIs, use multiple access tokens where each has the limited information needed for a particular API, or do something in between?
If each microservice is verifying the token then we can pass the same token. But the problem is – in between same token can be expired. If we use client_credentials grant then there we are having two issues: one is, we need to send the username/id in next microservice.
Do you need a token verification in microservices?
If we do the token verification in API gateway only (not in microservices) then from the API gateway we need to send the username in every microservices. And microservices implementation needs to be changed to accept that param/header.
When to use client tokens in Spring Security?
You should use client tokens using the client_credentials flow for interservice communication. This flow is exposed by default on the /oauth/token endpoint in spring security oauth. In addition to this, you could use private apis that are not exposed to the internet and are secured with a role that can only be given to oauth clients.
What do you need to know about access tokens?
Access tokens are signed, but they aren’t encrypted. Access tokens are used to provide access to APIs and resource servers. When your API receives an access token, it must validate the signature to prove that the token is authentic. Your API must also validate a few claims in the token to prove that it is valid.
How to protect an API in OAuth 2.0?
1 Browse to your API Management instance, and go to APIs. 2 Select the API you want to protect. For example, Echo API. 3 Go to Settings. 4 Under Security, choose OAuth 2.0, and select the OAuth 2.0 server you configured earlier. 5 Select Save.