1

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token and ID token). To my understanding, application server now has to contact the auth server to validate these tokens. If tokens are valid, the application server accepts the request. Otherwise, the request is rejected. Is this correct?

The main issue I have with this setup is the requirement to contact auth server for every request. Is there a standard way to avoid this? Is it possible to use a secret key (known to both the auth and application server) to validate a signature - similar to JWT. In this case what is the difference between OpenID Connect + OAuth2 and JWT?

Improve this question

1 Answer 1

Reset to default
1

You only send the access token to the application server, the ID token is kept in the client. And there's no reason why you cannot use a JWT as the access token. In this case, you can check the signature on the application server using the authorization server's public key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .