I want to know the recommended approach for having asynchronous back-end services that are secured through bearer tokens call each other?

I have an interactive web application that calls a back-end service passing an access token in the Authorization header. This back-end services starts an asynchronous job that then calls another back-end service, passing along the same access token. The problem arises when the access token has expired while the first job was processing.

Seems like one relatively straight forward approach would be to have the front end pass a refresh token to the back-end, which it can use to obtain a new access token.

Are there better approaches?


As always, you have more than one option and the right one depends on the exact scenario, but for example you could either:

  1. Support the OAuth 2.0 client credentials grant in your authorization server so that your back-end services can request tokens on their own behalf without involving the user Client Credentials Grant (source: Client Credentials Grant)

  2. Support a token exchange mechanism that would allow for a back-end service to exchange the received access token with another one that could allow to call other services using either user impersonation or delegation.

In scenario 1, given that the services could request token whenever required the expiration thing would be a non-issue.

For scenario 2, since the tokens were being issued to back-end services that you trust and would never leave the server-side boundary the lifetime of the token obtained could be much larger than the one used in the access token available to the web application which would also solve your expiration issue.

Also have in mind that scenario 1 would require your services to have the ability to be called either with a user associated token or with a service associated token so this could require some additional logic.

In relation to the refresh token approach, refresh tokens are not usually issued to browse-based applications due to the increased risks of leaks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.