A resource server is the backend application that protects data and actions and authorizes requests from client applications. A client obtains an access token from an authorization server, then presents that token when calling the resource server. The resource server validates the token and applies authorization rules. section 13.1 section 15.0
A resource server can validate and authorize requests through these token-handling paths:
- JWT validation: reads token claims and verifies that the expected authorization server issued the token, commonly through a public key set URI. section 15.1
- Opaque-token introspection: calls an authorization-server endpoint to determine whether the token is valid and retrieve client or user details. section 13.2.1
- User-based access: receives tokens produced through an authorization code flow, where the client exchanges an authorization code for an access token. section 13.3.1
- Service-to-service access: accepts tokens obtained with the client credentials grant when no user participates in the request. section 13.3.3
Configure a Spring JWT resource server
A minimal Spring Security configuration supplies the authorization server’s key-set URI and requires authentication for every request: `http.oauth2ResourceServer(c -> c.jwt(j -> j.jwkSetUri(keySetUri))); http.authorizeHttpRequests(c -> c.anyRequest().authenticated());`. A test endpoint such as `/demo` can then be called with `Authorization: Bearer <access-token>`. The resource server retrieves public keys, verifies the token signature, and authorizes the request. section 15.1
Figure 15.2 The resource server retrieves a set of public keys from the authorization server through an endpoint made available by the authorization server. The resource server then uses these keys to verify the signature of the access token.
Shows the key-set relationship: the authorization server exposes public keys, and the resource server uses them to verify access-token signatures. section 15.1
