nickufer / proxy-wasm-opaque-to-jwt Goto Github PK

Once ring supports builds for target=wasm32-wasi the jwt module has to be refactored to jsonwebtoken.

jsonwebtoken has a much better API and it is less painful to build upon.

The RFC for the OAuth 2.0 Token Introspection states that the introspect endpoint MUST have some form authorization:

To prevent token scanning attacks, the endpoint MUST also require
   some form of authorization to access this endpoint, such as client
   authentication as described in OAuth 2.0 [RFC6749] or a separate
   OAuth 2.0 access token such as the bearer token described in OAuth
   2.0 Bearer Token Usage [RFC6750].

Some certified OAuth2 authorization servers have the introspect endpoint exposed on a different "internal" port (like ORY Hydra) which should be guarded by own measures. Some authorization servers use specific authorized clients for that.

Basic authorization should at least be supported.
Possible extra would be client credentials Bearer token authorization.