10

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something.

I understand that the client authorises with the OAuth provider (Google for example) and allows the Resource Server to have access to the user's profile data. Then the client can send the access token to the resource server and be given back the resource.

But what does not seem to be covered in any of the documentation is what happens when the client app asks the resource server for a resource and passes it the access token. Everything I have read so far states that the resource server just responds with the requested resource.

But that seems like a huge hole, surely the resource server must somehow validate the access token, otherwise I could just fake up any old request and pass an old, stolen, fake, or randomly generated token and it would just accept it.

Can anyone point me at a simple to follow explanation of OAuth2 because so far the ones I have read feel incomplete.

Improve this question

3 Answers 3

Reset to default
8

Found it. Buried in the spec. They say the resource server should validate the access token with the auth server but that it's outside the scope of the document. Pity, I would have thought that token validation was an important part.

Improve this answer
3
  • 1
    About important parts, it might be worth reading this blog post for some background on the priorities for OAuth2.
    – Lars Viklund
    Commented Aug 2, 2012 at 7:18
  • 1
    Thanks for that, an interesting read. My requirements are rather simple in that I want to allow an iOS app to authenticate with google, twitter, facebook, etc, pass some form of authorisation to my server and have my server validate it and enable access to resources. The problem has proved more complex than I anticipated due to the complexities of understanding how this works and what I have to do where.
    – drekka
    Commented Aug 3, 2012 at 1:10
  • More precisely, Appendix A: "To validate the signature on the request, the protected resource could be able to submit the token identifier to the authorization server's introspection endpoint to obtain the necessary key information needed for that token. The details of this usage are outside the scope of this specification and will be defined in an extension[...]".
    – JulienD
    Commented Mar 8, 2017 at 10:47
2

Token validation is generally handled in 1 of 2 ways.

  1. The token is cryptographically signed using pre shared keys. This has obvious short comings for use in distributed, proliferating systems.

  2. The Authorization Server (AS) provides an endpoint for token validation or Introspection. This method was standardized in IETF RFC 7662 in October 2015, see: https://www.rfc-editor.org/rfc/rfc7662

This Stack Overflow Question / Answer includes examples from Google and Github: https://stackoverflow.com/questions/12296017/how-to-validate-an-oauth-2-0-access-token-for-a-resource-server

Improve this answer
0

you read spec for how to validate the token:

https://www.rfc-editor.org/rfc/rfc7662

hope this helps - pls mark it answer if it answers your query/problem

Improve this answer
1
  • 4
    Welcome to Software Engineering. In its current form, this answer does not meet our quality guidelines. We expect that answers should stand on their own - readers should follow external links only to gain a deeper understanding or to confirm sources and the relevant content should be quoted here.
    – Thomas Owens ♦
    Commented Feb 15, 2017 at 14:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.