4 ms·
I've been a little surprised at the adoption of "Machine-to-machine authorization" and JWTs in sever-to-server APIs. I can understand that it is more secure sin
by pbreit 5y ago
I've been a little surprised at the adoption of "Machine-to-machine authorization" and JWTs in sever-to-server APIs. I can understand that it is more secure since the the authorization token has a limited lifespan. And that JWTs could increase throughput by skipping the lookup. But seems unnecessary.
Is the "Bearer " authorization prefix going to stick?
- dwaite 5y agoOAuth in M2M is generally about separating out policy from the API interface, including the database of credentials which are valid, which clients are allowed which authorizations. That includes being able to make changes to these over time, without redeploying the API system. Note that OAuth and JWT are independent like Peanut Butter and Chocolate. I assumed you are talking about JWT access tokens issued from OAuth client credentials. > Is the "Bearer " authorization prefix going to stick? The Bearer authorization method has a certain format and behavior. It is unlikely to be changed to meet some desire for aesthetics. Conversely, it MUST be changed if you are sending data in a different format or with different behavior, such as with the DPoP extension to OAuth.