Oh. I remember having to deal with this. What a fucking nightmare.<p>See, a large part of the problem comes from the fact that there are really <i>two</i> things you want to encapsulate under the word "auth," (authentication and authorization), but OAuth2 only evan <i>attempts</i> one of them, and pretty badly at that.<p>That isn't to say OpenIdConnect is perfect or anything, but at least when you're doing the dance of encrypting a signed token (which, BTW, is the correct order, because in order to modify the payload and still have it validate, an attacker would need to break the encryption first in order to modify the payload into something malicious), having proper TTLs, and then, on top of that, having a way for the client/user side to signal the server/API resource side that "hey, I'm done with this token a little early, so just ignore it forever now, mmmkay," you reduce the amount of damage an attacker/malicious observer can do by intercepting one valid token.<p>Oh, but that's only if both the client/user side and the server/API resource side each implement their half of the protocol 100% correctly... which is, of course, nontrivial and full of landmines for you to step on. [0]<p>Now, I stepped in this particular pile of bullshit because the company I was working for at the time was in health tech, and we had a client who thought they wanted to exchange EPHI (electronic personal health information -- you know, the kind of data that HIPAA makes radioactive with its massive financial penalties) with our servers to do some other random crap I didn't really care about on their side. But, you can end up in the exact same place by replacing "exchanging EPHI" with "accessing any confidential or sensitive data," so don't think you're safe from all this just because you're not in the healthcare space.<p>Fortunately, in the end, our client realized that they did not, in fact, have the technical expertise and know-how to be able to deal with the security implications of what they were saying they wanted to do. So, our product and sales people talked them down to something that they could handle, and, which, fortunately, did none of give me headaches, cause me to lose sleep, or make me want to strangle people. And, that meant I could go back to paying attention to the things that actually mattered at the time, like making sure our RDS instance wasn't going to keel over, hiring a couple new senior SWEs, and occasionally even leading the team.<p>I see that turned into a bit more of a rant than I had expected, so I'm just going to cut myself off here. I hope anyone reading this is able to learn from my experience and maybe not drive themselves crazy in the process.<p>Thanks for coming to my TED talk.<p>---<p>[0]: For instance: <a href="https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/" rel="nofollow noreferrer">https://auth0.com/blog/critical-vulnerabilities-in-json-web-...</a>