OAuth 2.0 Token Revocation скачать в хорошем качестве

OAuth 2.0 Token Revocation

🔥More exclusive content: https://productioncoder.com/you-decid... Twitter:   / _jgoebel   Website: https://jangoebel.com Blog: https://productioncoder.com OAuth Token Revocation RFC: https://datatracker.ietf.org/doc/html... 00:00 OAuth 2 token revocation 01:12 OAuth 2 revocation endpoint parameters 01:34 Authorization between client and token revocation endpoint 02:28 access and refresh token revocation in OAuth 2 In OAuth access and refresh tokens can be revoked by sending them to the authorization server's token revocation endpoint. Depending on the authorization server's configuration it might invalidate all access tokens that were created with a particular refresh token if you send a refresh token to the token revocation endpoint and vice versa. An authorization server implementing token revocation must support the revocation of refresh tokens and it is recommended that it supports revoking access tokens as well. In typical deployments access tokens are self-contained tokens (e.g. JWTs) so that the protected resource can validate the access token by validating the token's digital signature or MAC. If the validation at the protected resource is only done locally then you might have a propagation delay. I.e. even though you have revoked one particular access token, the protected resource might still accept the revoked token because it does not know that it has been revoked. Only if the protected resource is reaching out to the token introspection endpoint it can know whether a particular token is active or not. Token revocation is one of the examples where a token gets invalid before the specified expiration time. Remember self-contained tokens are only a snapshot of what has been true when the token was issued. It does not take into account any revocations. Therefore, in security-sensitive deployments, it is at least recommended to call the token introspection endpoint for critical actions or to even use opaque tokens to avoid a propagation delay.