1

I've recently encountered the practice of systems using JWTs as Access Tokens. I have a concern and I'm not sure if it's unfounded:

I associate JWTs with the OpenID Connect protocol, where there are used as ID tokens. They have in intended audience. The claims in them are supposed to be for that audience only. For example I may be happy for one audience to have my phone number but not another.

On the other hand an opaque access token contains nothing other than my permission to access a resource. It's about delegation; that token can safely travel from system to system taking my permission with it (confirm?).

However if you effectively use an ID token as an Access Token, not only are you passing my permission to access a resource, but you're passing details about me.

Have I misunderstood something or should this be a real concern?

2

It's all dependent on whether the RP actually needs the information provided in the token to evaluate permissions.

You might have privacy issues if it's purely identifying information. The fact that it's a dual use token is problematic, but whether this actually poses a problem needs to be evaluated on a case by case basis.

Edit: Delegation of permissions is an unfortunate capability because these tokens are often bearer tokens -- whoever has the token can use the token. There's no way to separate this permission from the token, unless there's an explicit mechanism to delegate. In the OAuth world this is on-behalf-of (though I'm not sure how widespread it's used or accepted outside of Microsoft technologies).

The audience doesn't apply here because the audience dictates what service you're allowed to communicate to, not from. In order for this to be blocked the token needs to include ways to authenticate the client, and the client needs to authenticate to the service using a separate mechanism.

  • Thanks @Steve (+1) - just before I mark it as correct, would you be able to address the scenario of the access token traveling from system to system? So if I issue a token that delegates permission to read my email to an application, that application can pass the token on to another application. Is that correct? I.e. OpenID support the concept of an audience. OAuth does not. If that token is nothing but my permission, fine. But once that token includes claims (e.g. phone number) you can't pass on the permission without passing on the claims. – Andy N Dec 6 '18 at 8:37
  • Added more details on this. – Steve Dec 6 '18 at 17:53
  • Thank you @Steve (marked as correct) - I'm not sure the word "unfortunate" is warranted but that's a whole other discussion! :-) Good answer. – Andy N Dec 7 '18 at 8:27
  • I was mostly just harping on the Bearer part of this. It'd be nice of this was an opt-in capability, and not by design. – Steve Dec 7 '18 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.