All Questions
5 questions
2
votes
1
answer
385
views
Is it good practice to use the sub claim as the user_id in my app
The resources on the web I have seen so far suggest that the 'sub' claim in a JWT identifies the principal.
According to this question, at least for some identity provider implementations, one cannot ...
- 21
2
votes
3
answers
2k
views
Securing API for third party use
We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
- 185
0
votes
0
answers
180
views
oauth2 + angular - Most elegant way to pass the JWT auth token
I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
- 101
8
votes
3
answers
10k
views
Is caching Access Tokens on the back end of a Web Application a good idea? (access_token storage best practices)
Let's suppose we have a Web Application that uses an Open Id Connect service provider, the Web Application uses the Authorization Code flow to get access to a different API, and therefore gets an ...
- 99
0
votes
1
answer
2k
views
How Immadiately Blacklist and Block Access of Access Token using JWT?
I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful?
...