Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties

Question

So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything.

The API is also external facing so that third parties could access the API using client id + secret via OAuth2, this token is a lot more restricted to scope and limits.

The problem I'm facing is that I can easily grab hold of the token from logging in via the UI and use it to directly access the API, which has no limits.

---

I've done some searching around on best practices and many references to using server side cookies stored as HttpOnly, or encrypting the token with a key only the application knows but I wanted to ask the question in case someone has hit an issue like this before and knew a better solution?

Answer 1

A principle of security is that you have to consider everything that is ever sent to the client or installed on the client as available to the user.

You can and should use httponly and samesite to prevent the token to leak to other sites or applications. But you can't keep the user from using the token. They can hit F12, or use Fiddler to decryopt their own https traffic, emulate the OAuth flow with postman, or use a system level debugger etc. etc. Handing the user a token with more privileges than he or she should have is not a secure design.