Skip to content

Commit

Permalink
docs(aud): Remove techdebt item! about using aud claim for scopes
Browse files Browse the repository at this point in the history
  • Loading branch information
vpsx committed Feb 10, 2021
1 parent a31da4d commit ec60cb0
Showing 1 changed file with 0 additions and 21 deletions.
21 changes: 0 additions & 21 deletions TECHDEBT.md
Original file line number Diff line number Diff line change
@@ -1,22 +1 @@
# Tech debt

### Using 'aud' claim for scopes
- Observed: July 2020
- Impact: (If this tech debt affected your work somehow, add a +1 here with a date and note)
- +1 Zoe 2020 July 15 This is an example of a +1
- +1 Vahid Oct 2020

##### Problem:
Fence puts OAuth2 scopes into the 'aud' claim of access tokens.
##### Why it was done this way:
We don't know.
##### Why this way is problematic:
Per RFC7519 the aud claim [is not meant for scopes](https://tools.ietf.org/html/rfc7519#section-4.1.3).
##### What the solution might be:
GA4GH AAI [already requires](https://github.com/ga4gh/data-security/blob/master/AAI/AAIConnectProfile.md#access_token-issued-by-broker) that a 'scope' claim be included in access tokens issued by Passport Brokers. So as of July 2020 we will put scopes in the 'scope' claim. However, this is in addition to keeping them in the 'aud' claim. Ideally we would only have the scopes in the 'scope' claim.
##### Why we aren't already doing the above:
Fence presently guards several endpoints (e.g. /data, signed urls, SA registration) by checking the scopes in the 'aud' claim of the JWT. This code would need to be changed.
##### Next steps:
Address above.
##### Other notes:
n/a

0 comments on commit ec60cb0

Please sign in to comment.