Using proof-of-possession key semantics on OAuth 2.0 Provider
This chapter will present you with the means to implement an OAuth 2.0 solution where it is possible for the client to prove to the Resource Server that it is in possession of a given key through the usage of JWT tokens. Enabling this feature, increases the safeness of an API because it does not allow the usage of an access token that does not belong to the client sending a request. It can be implemented in many different ways as per the official specification described by RFC 7800 that is available at https://tools.ietf.org/html/rfc7800. Nevertheless, this recipe presents you with how to implement proof-of-possession key semantics using asymmetric keys.
Getting ready
Throughout this recipe we will create the OAuth 2.0 Provider that is composed by the Resource Server and the Authorization Server. This time both Authorization Server and Resource Server is implemented as a unique Spring Boot application using Java 8, Maven, Spring...