Access token appendix http header

jkbx 0
Viewed 21

I’m using a 3rd party identity provider that is a little restrictive with adding claims to the token.

As an alternative, I’m sending a token appendix together with that 3rd party token, but the appendix is in a custom http header (not the authZ header). The token appendix contains everything I wish the 3rd party token could contain. It also has a signature like a JWT and it takes the entire 3rd party token as well as itself into account when creating this signature. Therefore, it is bound to a particular 3rd party token.

Is that a well known solution (that maybe even has a special name)? Did I just invent something?

authorization http-headers asp.net-core authentication
1 Answers

Your case should be something like Custom Authorization Scheme.

But there is one thing you need to pay attention to:

A custom Authorization scheme can be unexpected and unsupported by some clients and leads to custom code anyway.
Say clients, say libraries, frameworks, reverse proxies. A custom header can be rejected or ignored. In the worse of the cases, it can also collide.
Collisions can be problematic, but all other issues are likely to be solved by tackling configurations.

As for choosing Authorization or custom header, in my opinion, technically, both take me almost the same work and time to implement, with a slight difference. I had more room for design when I implemented custom headers. However, more room for design also meant more chances to overcomplicate things or reinvent the wheel.

Hope this can help you.

userR7Qg10
Related