auditing-oauth-token-audience-and-scope-trustlisted

# Auditing OAuth token audience and scope trust: a token is only good for what it was issued for A bearer access token is a claim with a precise domain: it was issued by a particular authorization server, for a particular audience, carrying a particular scope, and it authorizes only what those three agree on. A resource server that checks the signature but not the audience, issuer, and scope is trusting a token far beyond what it was minted for. The confusions are specific and common. A token issued for service A is presented to service B, and if B does not verify the audience it accepts A's token as its own. A scope is treated as coarser than it is, or a missing-scope check lets any valid token reach a privileged operation. A token from a different authorization server is honored by a party that only meant to trust one issuer. Each is a token used outside its domain. The audit checks that every token is validated against the audience, issuer, and scope the operation requires, not merely that it is a well-formed, signed token. You audit this by testing whether a token good for one thing is accepted for another. ## When to use - A resource server accepts OAuth or bearer access tokens to authorize calls. - Multiple services or audiences accept tokens, and the audience or issuer may not be verified per service. - Scopes gate operations, and the resource server may not check the specific scope each operation requires. ## Scope check Test token trust only against services you