I'm looking to verify the security of the OAuth mechanism for an application I'm testing. The application uses Okta for SSO and the PKCE OAuth flow.
What I'm not clear on is how the backend is verifying the Access Token, given the configuration supplied to the Okta SDK. The only configuration passed to the SDK is the Okta Domain - https://dev-xxxxx.okta.com
On monitoring the traffic from the app, I can see calls to the following endpoints on application startup. Following this no further calls appear to be made to Okta on authorizing requests.
It appears that the later of the two requests below fetches a set of keys. I'm thinking maybe these keys are used in the verification of the access token, but since these keys are publicly available via the URL, I'm unsure how this would work.
- https://dev-xxxxx.okta.com/oauth2/default/.well-known/openid-configuration
- https://dev-xxxxx.okta.com/oauth2/default/v1/keys
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = OktaDefaults.ApiAuthenticationScheme;
options.DefaultChallengeScheme = OktaDefaults.ApiAuthenticationScheme;
options.DefaultSignInScheme = OktaDefaults.ApiAuthenticationScheme;
})
.AddOktaWebApi(new OktaWebApiOptions
{
OktaDomain = Configuration["OktaDomain"],
ClockSkew = TimeSpan.FromMinutes(2)
});
services.AddAuthorization(options =>
{
// ...
});
So my question is - what mechanism is Okta using to verify that the signature of the JWT token is valid on the backend?