Intermediate LevelAuthentication & Authorization
What is OAuth 2.0 Token Introspection (RFC 7662) and when should Resource Servers use it?
❓ Interview Prompt: Explain RFC 7662 Token Introspection, opaque tokens, active status queries, and trade-offs vs local JWT validation.
While JWTs can be verified locally using public keys, Opaque Tokens (random string handles) require querying the Authorization Server to check validity. OAuth 2.0 Token Introspection (RFC 7662) standardizes this lookup.
Execution Flow:
1
Resource Server receives opaque token: 'Authorization: Bearer op_xyz123'.
2
Resource Server makes authenticated POST request to Auth Server '/introspect' endpoint.
3
Auth Server returns JSON metadata:
'{ "active": true, "scope": "read write", "sub": "usr_1042", "exp": 1770000000 }'
Trade-Offs:
•
Advantage: Instant token revocation checks on every API request.
•
Drawback: Introduces network latency bottleneck by querying the Auth Server on every API call.
Code Implementation Example
typescript
async function introspectOpaqueToken(token: string): Promise<boolean> {
const res = await fetch('https://auth.company.com/oauth/introspect', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Authorization': 'Basic ' + Buffer.from(CLIENT_ID + ':' + CLIENT_SECRET).toString('base64')
},
body: new URLSearchParams({ token })
});
const data = await res.json();
return data.active === true;
}💡Querying OAuth 2.0 Token Introspection endpoint (RFC 7662) for opaque token status.
🎯 Interview Key Takeaway
OAuth 2.0 Token Introspection (RFC 7662) queries the Auth Server to check real-time validity of opaque access tokens.
#Token Introspection#RFC 7662#Opaque Tokens#OAuth 2.0#Intermediate
Back to all Authentication & Authorization Questions→