Resource server
A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.
Spring in Action, Sixth Edition
A resource server is a server that protects resources by validating access tokens and enforcing their scopes before serving requests.
- How it is used
- Protects a REST API by checking access tokens and scopes before allowing requests to protected resources.
- How deep it goes
- Works through dependency, endpoint rules, JWT enablement, JWK configuration, and request tests; stops short of implementing token validation internals.
- Examples
- Uses ingredient POST and DELETE endpoints, Spring Security configuration, and curl requests with and without Bearer tokens.
- What you can do after
- Operate/configure it with Spring Security to require distinct scopes for ingredient creation and deletion.
Read how Spring in Action, Sixth Edition explains resource server →
Spring Security in Action, Second Edition
A resource server is an OAuth server that hosts protected resources and accepts valid access tokens for authorized requests.
- How it is used
- Secures backend resources and use cases by authenticating client requests and enforcing authorization with access tokens.
- How deep it goes
- Builds Spring implementations for JWT validation, opaque-token introspection, authorization rules, testing, and reactive configuration.
- Examples
- Uses `/demo` and `/hello` endpoints, bearer-token curl requests, public key sets, JWT configuration, and opaque-token introspection.
- What you can do after
- Build it from scratch with Spring Security, configure JWT or introspection validation, require authentication, and test protected endpoints.
Read how Spring Security in Action, Second Edition explains resource server →
Software Security for Developers
A resource server is an application backend that hosts protected data and enforces authorization for requests bearing access tokens.
- How it is used
- Protects backend data and business operations while serving requests from user-facing applications or other services.
- How deep it goes
- Explains actors, authorization-code and client-credentials flows, token validation, and introspection without detailing backend implementation.
- Examples
- Uses a shopping-list request, ACME payment calls, signed-token verification, and opaque-token introspection as concrete examples.
- What you can do after
- Evaluate how a backend receives, validates, and authorizes OAuth2 access-token requests from users, applications, or services.
Read how Software Security for Developers explains resource server →
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
A resource server is a service that hosts protected resources and validates access tokens before providing them to authorized clients.
- How it is used
- Protects REST API resources by receiving access tokens from clients and controlling access to hosted resources.
- How deep it goes
- Defines the bearer and OAuth 2.0 flow, but stops short of implementation commands and token-validation internals.
- Examples
- Uses a REST API bearer-authentication diagram showing token issuance followed by access to a desired resource.
- What you can do after
- Evaluate how bearer authentication and OAuth 2.0 separate token issuance from protected-resource access.
Read how Acing the CCNA Exam: Volume 2 Advanced Networking and Security explains resource server →
Related concepts
- API keyuses · An API key is a credential used to identify or authorize a client accessing an application programming interface.
- JSON Web Tokenuses · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
- OAuthpart of · OAuth is an authorization framework that enables a client to obtain limited, delegated access to protected resources without receiving the resource owner's credentials.
- token introspectionuses · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
- clientkind of · A client is a person, organization, device, or software component that receives or uses a product, service, resource, or functionality provided by another entity.
- Spring Securityproduced by · Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.