Lion Cipher Lab
Issue audience-restricted access tokens with OAuth 2.0 Resource Indicators (RFC 8707)
- Identity & Access Management
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The moment one login server (an authorization server) starts protecting more than one API, a quiet assumption becomes dangerous: that a token is a token. A plain access token is a BEARER token -- whoever holds it can use it -- and if it carries no record of WHICH API it was meant for, then a token your browser obtained to call your company's billing API can be replayed, unchanged, against the admin API, the internal reporting API, or a partner's API behind the same login server. Attackers who phish, log, or SSRF a single token get the run of everything that server guards. This is the OAuth…
What you'll learn
- why a plain access token with no audience binding lets a token minted 'for API A' be replayed at API B (the confused-deputy / token-replay risk)
- using the OAuth 2.0 `resource` parameter (RFC 8707 Resource Indicators) so a client names the single API a token is for
- minting a token whose `aud` claim is exactly that resource, and writing a per-resource-server verifier that accepts only its own identifier
- handling the `aud` claim as a single string OR a JSON array, as RFC 7519 requires
- making the authorization server reject a `resource` it does not recognise, so an attacker cannot request a token for an API that does not exist
- the honest limit: audience restriction shrinks the blast radius of a LEAKED token but does not stop one stolen for the right audience -- that needs sender-constraining (mTLS or DPoP)
Steps in this lab
- The idea in plain language: tokens, claims, audience, and the confused deputy
- How this differs from the neighbouring token labs
- Set up a scratch folder and a tiny local token signer
- BEFORE: an authorization server that ignores which API the token is for
- AFTER: name the resource (RFC 8707) and bind it into `aud`
- Measure it: the replay is now rejected, and count the rejections
- The honest negatives: what audience restriction does NOT fix
- When to reach for this, and how a pro wires it up
- Clean up