I am considering a usecase where an OAuth2 client obtains an access token to access multiple resource servers.
Based on spec, to protect against token redirect attack:
to deal with token redirect, it is important for the authorization
server to include the identity of the intended recipients (the
audience), typically a single resource server (or a list of resource
servers), in the token.
This means that in our usecase, the access token can have a list of audience URIs and then each resource server would then verify the token has access to its resource.
However, according to the draft spec of the Resource Indicators for OAuth2, the authors state:
I continue to question the value of allowing multiple resources vs the functional and security complexity that comes with doing so. Writing the preceding paragraph just underscores that concern. So just noting it here.
I have also noticed that identity management providers such as Auth0, only support single audience field values and instead point to using a combination of
audience for multiple resource servers.
Other providers support multiple audiences.
So... is there a security problem with having multiple audience values?
It seems to me
audience have different intentions and so mixing them up is not necessarily the right approach. According to:
Scope, from Section 3.3 of OAuth 2.0 [RFC6749], sometimes is overloaded to convey the location or identity of the resource server, however, doing so isn't always feasible or desirable. Scope is typically about what access is being requested rather than where that access will be redeemed (e.g. email, user:follow, user_photos, and channels:read are a small sample of scope values in use).
Any thoughts on this would be appreciated. Thank you!
Token redirect: An attacker uses a token generated for consumption by one resource server to gain access to a different resource server that mistakenly believes the token to be for it.