> Intercepting this single token allows attacked to craws whole internal system. It can intercept it, but can not change it. It can replay it eventually (even

> Intercepting this single token allows attacked to craws whole internal system. It can intercept it, but can not change it. It can replay it eventually (even that shortly, depending on timeframe of your access token which is usually minutes) but you can protect against it. > This would require UA token to contain audience claim of every single internal service, this is unlikely to pass security review. I have penetration tests on my main service. Sub-services are not accessible and can be secured to desired level on the internal network. I never had security inspections on internal services (I work on highly critical gov systems). Maybe in some domains its like you say but I believe its generally not a problem. Furthermore, we need to have some perspective on this - there are multiple easier ways to hack a service and there probably exists big number of other exploits that are easier to achieve.