51–52 of 52 posts
Earlier quoted context omitted.
Doesn't the nature of an OAuth server imply that it can be added to existing infrastructures? Or is there an issue you foresee with non-Hydra libraries?
No, Hydra works with every existing solution :) You can read more on this topic in the guide: https://ory-am.gitbooks.io/hydra/content/oauth2.html
Earlier quoted context omitted.
You have to query token validation endpoint to have your reference token validated. That's how oauth2 works. With OpenId connect you get JWT which can be validated without a call to the identity provider.
One thing I've not quite got my head around with JWT is not authenticating tokens with the server on each request - am I really just meant to assume a token is trusted until it's expiry time? What if a user signs out all their sessions in the meantime, or an employee is fired and needs access revoking? As far as I can tell I do just have to use short-lived tokens and renew them frequently but that comes with its own…
You other option is to allow blacklisting of JWTs per client. However, this will add additional overhead of making an HTTP request to check if a token is blacklisted. That's how Auth0 does it in their commercial OpenId Connect provider.