protected_resource bearer token validation

[ll4strw]

I am wondering if it is desirable to add extended checks on a response obtained as a result of a token introspection request. The code below seems to grant access to protected resources as long as a bearer token is still active and its associated user exists in iRODS:

irods_client_http_api/core/src/common.cpp

Lines 402 to 429 in 48b6375

	auto mapped_value{irods::http::process_stash::find(bearer_token)};
	if (!mapped_value.has_value()) {
	// If we're running as a protected resource, assume we have a OIDC token
	if (irods::http::globals::oidc_configuration().at("mode").get_ref<const std::string&>() ==
	"protected_resource") {
	body_arguments args{{"token", bearer_token}, {"token_type_hint", "access_token"}};
	auto json_res{hit_introspection_endpoint(url_encode_body(args))};
	// Validate access token
	if (!json_res.at("active").get<bool>()) {
	logging::warn("{}: Access token is invalid or expired.", __func__);
	return {.response = fail(status_type::unauthorized)};
	}
	// Do mapping of user to irods user
	auto user{map_json_to_user(json_res)};
	if (user) {
	return {.client_info = {.username = *std::move(user)}};
	}
	logging::warn("{}: Could not find a matching user.", __func__);
	return {.response = fail(status_type::unauthorized)};
	}
	logging::error("{}: Could not find bearer token matching [{}].", __func__, bearer_token);
	return {.response = fail(status_type::unauthorized)};
	}

What happens if a valid and active bearer token meant for another app/client, but for a valid iRODS user, is presented to the API server? Would this be let in? Could the token validation be performed also on the response client_id and aud? For instance, I could imagine an extra configuration parameter called audience to add an extra level of security

std::string aud = irods::http::globals::oidc_configuration().at("audience").get_ref<const std::string&>();
if (json_res.at("aud").get<string>() != aud) {
	logging::warn("{}: Access token is not meant for me.", __func__);
	return {.response = fail(status_type::unauthorized)};
}

Thanks in advance, L.

[ll4strw]

More info here: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#name-audience-restricted-access-