Announcement Announcement Module
Collapse
No announcement yet.
Validation of resource request Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • Validation of resource request

    The OAuth 2 spec states that
    The client accesses protected resources by presenting the access token to the resource server. The resource server MUST validate the access token and ensure that it has not expired and that its scope covers the requested resource. The methods used by the resource server to validate the access token (as well as any error responses) are beyond the scope of this specification but generally involve an interaction or coordination between the resource server and the authorization server.
    So within the Spring OAuth lib is this performed by the TokenServicesUserApprovalHandler? What is the default behavior if I don't supply my own?

  • #2
    Originally posted by samuel_coutinho View Post
    So within the Spring OAuth lib is this performed by the TokenServicesUserApprovalHandler?
    Not really. That's used when a token is granted. The OAuth2AuthenticationProcessingFilter and it's authentication manager process an incoming request, and they check for a resource id if there is one. They delegate token hydration to the ResourceServerTokenServices, and if you use DefaultTokenServices then it will check for expiry. None of these components know anything about scope since that is business content, so you have to specify access rules in your filter configuration (e.g. using a ScopeVoter as in the sparklr sample).

    Comment

    Working...
    X