Intermediate LevelAuthentication & Authorization
What is OAuth 2.0 Token Exchange (RFC 8693) and how does it handle microservice delegation?
❓ Interview Prompt: Explain RFC 8693 Token Exchange, down-scoping tokens, impersonation vs delegation, and microservice token boundaries.
In microservice architectures, passing an incoming user access token directly through 10 internal downstream microservices violates the Principle of Least Privilege. OAuth 2.0 Token Exchange (RFC 8693) enables token transformation.
How Token Exchange Works:
1
An edge microservice receives a high-privilege user access token.
2
Before calling an internal backend service, the edge service calls the Auth Server '/token' endpoint with 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange'.
3
Exchanges the original token for a down-scoped internal access token specifically audience-bound to the target internal microservice!
Code Implementation Example
typescript
// Exchanging user access token for down-scoped billing service token
async function exchangeTokenForBillingService(userAccessToken: string): Promise<string> {
const res = await fetch('https://auth.company.com/oauth/token', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
subject_token: userAccessToken,
subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
audience: 'https://api.billing.internal'
})
});
const data = await res.json();
return data.access_token;
}💡Exchanging user access token for down-scoped internal billing service token.
🎯 Interview Key Takeaway
OAuth 2.0 Token Exchange (RFC 8693) down-scopes and re-binds tokens when passing requests between internal microservices.
#Token Exchange#RFC 8693#Microservices#Delegation#Intermediate
Back to all Authentication & Authorization Questions→