OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Question

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.

Both resource servers - RS1 and RS2 use authorization server - AS

If a client requests an access token for RS1 and passes it to RS2, how will RS2 validate it and fail?

One possibility is to depend on scope checks - but it seems scope checks are nothing more than string comparisons (or am I wrong here?). In that case, if both RS1 and RS2 define exactly the same scope name (e.g. Read) then there is no reliability even with scopes.

Answer 1

You can also use JSON Web Token (JWT) (https://www.rfc-editor.org/rfc/rfc7523).

The JWT includes an "aud" parameter to specify the audience of the issued token. Resources servces must check the signature of the token and the data it contains.

See https://www.rfc-editor.org/rfc/rfc7523#section-3

Another solution would be to associate a resource server to the access token by creating a new property (containing a name or url or the client_id to identify your authorized "resource server"). Then checking this parameter depends on how the communication between your authorization server and your resource servers works.

Answer 2

You could add some kind of namespace to the scopes. For RS1 the scopes are prefixed with "RS1::" for RS2 the scopes are prefixed with "RS2::". So if both resource servers have a scope read, the scope for RS1 would be "RS1::read" for RS2 it would be "RS2::read".