Is token introspection necessary?

Is token introspection necessary?

You don’t need to call introspect , but you can if your code wants to check and see that a JWT is valid. However, if you have a resource server which isn’t sure about the JWT it receives or really wants to double check it, you can call the introspect endpoint.

What is the purpose of the introspection endpoint?

Using a token introspection endpoint means that any resource server will be relying on the endpoint to determine whether an access token is currently active or not. This means the introspection endpoint is solely responsible for deciding whether API requests will succeed.

How token introspection works?

The Token Introspection extension defines a mechanism for resource servers to obtain information about access tokens. With this spec, resource servers can check the validity of access tokens, and find out other information such as which user and which scopes are associated with the token.

What is the introspection endpoint?

The introspection endpoint enables holders of access tokens to request a set of metadata about an access token from the OpenID Connect Provider that issued the access token. The access token must be one that was obtained through OpenID Connect or OAuth authentication.

How do you use an introspect endpoint?

Procedure

1. Set up client authentication with the client ID and password for a registered OpenID Connect Client in the HTTP Basic Authorization header of a GET or POST request.
2. Include the string value for the access token as a parameter in the GET or POST request to the introspection endpoint.

What is the OAuth 2.0 token introspection endpoint?

OAuth 2.0 token introspection endpoint. 1. Inspecting identifier-based access tokens. OAuth 2.0 secured resource servers must check the access token of each client request before carrying on with the actual processing of the request.

Is it safe to use token introspection endpoint?

End-user clients should not be allowed to use this endpoint since the response may contain privileged information that developers should not have access to. One way to protect the endpoint is to put it on an internal server that is not accessible from the outside world, or it could be protected with HTTP basic auth.

How does the OIDC and JWT specs help?

The OAuth2, OIDC, and JWT (and supporting) specs provide several mitigating controls to help ensure the integrity of an OIDC login flow, including: Transport Layer Security ( TLS /SSL) Identity Provider (IdP) server certificate is verified by the browser to ensure that the browser is communicating with the real IdP.

How to validate a JWT access token in express?

The introspection endpoint requires four parameters: We retrieve the user’s access token from Express’s session, set the token type hint to ‘access_token’ since that is the type of token we are sending, and we read the OIDC client ID from the app’s environment variables. The endpoint expects the POST body to be in a URL-encoded form format.