So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything.

The API is also external facing so that third parties could access the API using client id + secret via OAuth2, this token is a lot more restricted to scope and limits.

The problem I'm facing is that I can easily grab hold of the token from logging in via the UI and use it to directly access the API, which has no limits.

I've done some searching around on best practices and many references to using server side cookies stored as HttpOnly, or encrypting the token with a key only the application knows but I wanted to ask the question in case someone has hit an issue like this before and knew a better solution?

New contributor
Alexander Johansen is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

A principle of security is that you have to consider everything that is ever sent to the client or installed on the client as available to the user.

You can and should use httponly and samesite to prevent the token to leak to other sites or applications. But you can't keep the user from using the token. They can hit F12, or use Fiddler to decryopt their own https traffic, emulate the OAuth flow with postman, or use a system level debugger etc. etc. Handing the user a token with more privileges than he or she should have is not a secure design.

Your Answer

Alexander Johansen is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.