liveBook · Manning

Reference token

As explained in ASP.NET Core in Action, 3e

A reference token is an opaque credential whose associated claims must be retrieved from the identity provider before a protected API can use them.

A reference token is an opaque credential, usually a random string, that carries no claims by itself. When a protected API receives it, the API exchanges it with the identity provider to retrieve the claims needed for authorization. section 25.2

Reference tokens trade self-contained validation for privacy and revocation control:

  • Keep claims away from the client, improving privacy compared with tokens whose contents are directly readable. section 25.2
  • Allow revocation at the identity provider, unlike self-contained tokens that generally cannot be revoked after issuance. section 25.2
  • Require an additional HTTP round trip whenever the API needs to retrieve the claims. section 25.2

How ASP.NET Core in Action, 3e covers it

How deep it goes
Defines the token, contrasts it with self-contained JWTs, and explains privacy, revocation, and extra-request tradeoffs.
Examples
Uses a random string as the token and a retrieved JWT as an example of exchanged claims.
What it assumes
Builds on bearer-token authentication, API authorization, claims, and identity-provider interactions.
What you can do after
Evaluate/understand when privacy and revocation outweigh the latency of an identity-provider request.
How it connects
Connects bearer tokens, access tokens, JWTs, claims, protected APIs, and identity providers.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.