The token is genuine and the request is forbidden
A hypothetical API receives a correctly signed, unexpired token. It accepts the request and returns another tenant's invoice. The security log proudly records āJWT valid.ā
The signature proved who issued the claims. It did not prove this request was permitted.
Separate identity, delegation, and resource policy
OAuth 2.0 delegates access using scoped access tokens. OpenID Connect adds an authentication layer and ID tokens intended for the client. Do not substitute an ID token for an API access token just because both may look like JWTs. Validate the token type, issuer, audience, lifetime, allowed algorithm, and required scopes under the provider's profile; then enforce tenant/resource ownership.
A token says sub=alice and has invoice:read. What still needs checking before returning invoice 123?
Authorization code flow with PKCE binds the code redemption to a verifier known to the initiating client. Generate a cryptographically random verifier, send its S256 challenge, bind the authorization response to the initiating session, and redeem with the verifier. Use a maintained library for redirect validation, state/nonce handling, and token validation. Current OAuth security guidance requires PKCE for public clients and recommends it for confidential clients. OAuth security best current practice.
Local verification creates a revocation question
An opaque session ID refers to server-side state. Revoking it changes that state, though replicas and authorization caches still determine how quickly the change is observed. A self-contained signed token can be verified locally, reducing per-request lookups, but it can remain cryptographically valid after logout.
Short access-token lifetime bounds one exposure; refresh-token rotation or sender constraint protects renewal according to its protocol. Reusing an old rotated refresh token can indicate theft, but legitimate parallel refreshes need a well-defined client/server handling policy. Revoking a refresh grant does not automatically erase already issued access tokens at services that only check signature and expiry.
Cache public verification keys, refresh them asynchronously, and rate-limit refresh on unknown kid. Reject unsupported algorithms rather than following whatever the token header asks for. Define behavior during key-provider outage and compromised-key revocation; an infinitely cached key is not an outage strategy.
A stale negative can authorize the wrong request
A local Bloom filter can summarize revoked token IDs and send possible matches to an authoritative store. A negative only proves absence from the filter's inserted set. If the newest revocation has not arrived, the filter's mathematical no-false-negative property does not help.
Strict immediate revocation requires an authoritative freshness/ordering guarantee or an online check on the sensitive path. If eventual propagation is acceptable, state and monitor the lag. Never reject a user solely on a Bloom false positive without an exact lookup.
PASETO provides versioned token formats with fixed cryptographic choices; it does not remove audience checks, authorization, expiry, or revocation design. WebAuthn/passkeys provide authentication assertions and phishing-resistant origin binding under their protocol; they are not a replacement format for every subsequent API session. Treat these as different layers rather than competitors in one latency ranking.
Follow the bearer credential
A bearer token grants whoever possesses it the rights it carries. Avoid logging it. Choose browser storage and session architecture against actual XSS/CSRF threats: an HttpOnly cookie prevents JavaScript reads but still needs appropriate cross-site request protection; a token accessible to JavaScript has different exposure. Use established framework protections rather than hand-built authentication code.
Monitor authorization denials separately from signature failures, key-refresh load, token reuse, revocation lag, and cross-tenant access attempts. Security correctness is an end-to-end property through the gateway and service.
Mental model: valid cryptography authenticates evidence. Policy decides whether that evidence authorizes this action on this resource now.
Transfer: the signed search result
A vector search returns documents across all tenants, then removes unauthorized results before responding. Is the token-validation layer sufficient to establish search correctness?
Source trail: 20-oauth2-oidc-and-distributed-token-authentication. See the source map for consolidation and reference-retained material.