3 ms·
> The audience and scope claims exist to address that problem. Provided that RPs reject JWTs issued for other audiences than themselves there’s no security weak
by chipdart 2y ago
> The audience and scope claims exist to address that problem. Provided that RPs reject JWTs issued for other audiences than themselves there’s no security weakness here.
My interpretation is that the audience and scope claims, as other features like nonce, are in place to prevent tokens from being intercepted and misused, not to facilitate passing tokens around.
- Aeolun 2y agoDon’t see how those prevent tokens from being misused? They just prevent anyone from issuing tokens as you. Not by themselves, but if you implement your server correctly.
- chipdart 2y ago> Don’t see how those prevent tokens from being misused? The purpose of a nonce is to explicitly prevent the token from being reused. The purpose of the other claims is to prevent them from being accepted (and used) in calls to other services. If you implement your server correctly, each instance of each service is a principal which goes through auth flows independently and uses its own tokens. There is no token sharing.