1

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format

{
"iss": "https://server.example.com",
"sub": "[email protected]",
"exp": 1493726400,
"nbf": 1493722800,
"cnf":{
"x5t#S256": "bwcK0esc3ACC3DB2Y5_lESsXE8o9ltc05O89jdN-dg2"
}
}

However, while I read this The OAuth 2.0 Authorization Framework it states that there exist two different types of an access token namely bearer and MAC token.

So which one can I use? Which are the differences? Which is the format that can I use as a follow the first link? Is the token related to the grand type that is used?

As far as I understand in oauth2 the bearer token is commonly used. Following the guide Access Token Response from here, I see that the access token has the following format

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
 
{
  "access_token":"MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3",
  "token_type":"bearer",
  "expires_in":3600,
  "refresh_token":"IwOGYzYTlmM2YxOTQ5MGE3YmNmMDFkNTVk",
  "scope":"create"
}

So how jwt and bearer token are used together? Which is the format used?

0

0

You must log in to answer this question.

Browse other questions tagged .