This chapter covers
- Why OAuth bearer tokens don’t fit all scenarios
- The proposed OAuth Proof of Possession (PoP) token type
- The proposed Transport Layer of Security (TLS) token-binding method
OAuth is a protocol that provides a powerful delegation mechanism on top of many different applications and APIs, and at the core of the OAuth protocol is the OAuth token. So far in this book, all of the tokens that we’ve used have been bearer tokens. As we covered in chapter 10, bearer tokens can be used by anyone who carries, or bears, them to the protected resource. This is an intentional design choice used in many systems, and they’re far and away the most used type of token in OAuth systems. In addition to the simplicity of using bearer tokens, there’s a simple reason for this prevalence: as of the publication of this book, these are the only kinds of tokens defined in a standard specification.[1]
1 RFC 6750 https://tools.ietf.org/html/rfc6750
However, there are some efforts currently under way to move beyond bearer tokens. These efforts aren’t yet full standards, and the details of their implementation are sure to change between the time this book is published and the specifications are finalized.