I am dealing with this problem. I have created a REST API with some resources. Some are app to app based and therefore I expect to get only the
Authentication header with my token (client_credentials token). I am using keycloak to validate the tokens.
Now I am introducing other resources are that are client-owned, these resources receive a token but this time is a user token (password token).
Even though I know by definition this token should be validated only by the user token (since is the owner in the theory of the resource) Im afraid that Im missing the validation of the app token.
Ive seen some app that validate multiple tokens to match multiple security parameters and i am wondering what is the best approach.
The current flow is this:
Having 2 applications
- Website APP
- Backend APP
- Client logins via keycloak on website app.
- Keycloak responds with a user token
- User performs actions on the website app using user's tokens given by keycloak, frontend validates this token with keycloak
- Frontend app requests its own token to keycloak, its a unique token per app
- Frontend app calls backend to get non-user specific info, its a rest call using frontend's app token
- User perform an action in the frontend that is user's specific (like edit its own user info), frontend requests to the backend using again only the frontend app token.
Having this flow I can notice never validate website app token, except in the scenarios when website app requests information that is not user-related, like requesting list of products, the weather of whatever the backend responds. Should then the frontend gets the user#id front he current session/user token and send it as another parameter to the backend? or should it just forward the user's token? should it request using both tokens in different headers so the backend will validate both?
What is the standard in these cases? Is there any documentation I can find that denies the validation of multiple tokens or recommends to keep validating just one?