Senior LevelAuthentication & Authorization
What are OAuth 2.0 Resource Indicators (RFC 8707) and how do they bind tokens to specific API target audiences?
❓ Interview Prompt: Explain RFC 8707 Resource Indicators, audience binding (aud claim), resource query parameters, and preventing cross-API token replay.
If an application uses a single access token across multiple independent microservice APIs (e.g. both Billing API and Calendar API), a compromised Calendar API could capture the token and replay it against the Billing API! OAuth 2.0 Resource Indicators (RFC 8707) prevents token replay across APIs.
How Resource Indicators Work:
1
When requesting an authorization code or token, the client includes explicit 'resource' URI parameters:
'GET /authorize?client_id=app&resource=https://api.billing.company.com'
2
The Auth Server issues an access token with its Audience ('aud') claim bound strictly to 'https://api.billing.company.com'.
3
If the token is presented to the Calendar API, the Calendar API rejects it because the 'aud' claim does not match!
Code Implementation Example
typescript
// Validating JWT Audience (aud) claim in Resource Server API
function validateAudience(decodedTokenClaims: jwt.JwtPayload, expectedAudience: string) {
const tokenAudience = decodedTokenClaims.aud;
const matches = Array.isArray(tokenAudience)
? tokenAudience.includes(expectedAudience)
: tokenAudience === expectedAudience;
if (!matches) {
throw new Error("Security Alert: Access token audience (" + tokenAudience + ") does not match expected target resource (" + expectedAudience + ")!");
}
}💡Validating JWT audience (aud) claim to prevent cross-API token replay.
🎯 Interview Key Takeaway
Resource Indicators (RFC 8707) bind access tokens to specific API target audiences (aud), preventing cross-API token replay.
#Resource Indicators#RFC 8707#Audience Binding#OAuth 2.0#Senior
Back to all Authentication & Authorization Questions→