5 ms·
Opaque token is called opaque for a reason - only the issuer knows what's in it, whether it has content or not, is it an identifier or an encrypted payload, wha
by jimbobimbo 4y ago
Opaque token is called opaque for a reason - only the issuer knows what's in it, whether it has content or not, is it an identifier or an encrypted payload, what to do to make use of it.
Content-full and content-less break that abstraction.
- marcosdumay 4y agoThis is a hard area to work on, everybody that says something apply their own meanings to the words, you can never know what anybody else says. Anyway, I have always understood it as the token being opaque for the verifier too, that only ever tested it for equality. The token that is opaque only for the holder is normally called "encrypted". It may not be opaque to the issuer, but that doesn't change much. But anyway, depending on what you read, you will get different meanings.
- P5fRxh5kUvp2th 4y ago> Anyway, I have always understood it as the token being opaque for the verifier too Which falls flat on its face the second you realize the "verifier" can pull out information based upon that opaque token. It just means the intent is not for the person receiving it to do anything except reflect it back on subsequent requests. That's it. Typically it's done by handing something that is meaningless without context, said context not being available to the consumer being issued the token. But there is absolutely nothing that says you can't hand them a JWT meant to be used as an opaque token. If you're really worried about it, encrypt that bad boy before giving it to them.