single sign on - How can restrict the use of Issued access token of one machine in another machine -
i using thinktecture idenity server v3 idenity provider. issues me access tokens. using these access tokens web api communication. works perfectly.
my question if got issued token , try access web api using access token, he/she got access. verified it, got access. how can restrict access token being used issued machine?
you right - there standard called bearer tokens. whoever has token, can use it. that's why paramount use transport protection all network communication.
there upcoming specs proof of possession semantics , request signatures.
Comments
Post a Comment