{"repo":"curityio/nginx_phantom_token_module","free":true,"listed":false,"github":"https://github.com/curityio/nginx_phantom_token_module","clone":"git clone https://github.com/curityio/nginx_phantom_token_module.git","description":"NGINX module that introspects phantom access tokens according to RFC 7662","language":"Perl","stars":71,"topics":["nginx","api-gateway","oauth2","introspection","phantom-token"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"Phantom Token NGINX Module NGINX module that introspects access tokens according to RFC 7662, producing a \"phantom token\" that can be forwarded to back-end APIs and Web services. Read more about the Phantom Token approach. This module, when enabled, filters incoming requests, denying access to those which do not have a valid OAuth access token presented in an Authorization header. From this header, the access token is extracted and introspected using the configured endpoint. The Curity Identity Server replies to this request according to the standard. For an active access token, the body of the Curity Identity Server's response contains the JWT that replaces the access token in the header of the request that is forwarded by NGINX to the back-end. If the token is not valid or absent, no request to the back-end is made and the caller is given a 401, unauthorized, error. This flow is shown in the following diagram: The initial calls by the app (web or native) are done using OpenID Connect (OIDC). The important part is that the token that is issued is an opaque access token. It is a GUID or UUID or a few handfuls of random bytes; there is no identity-related data in this token. It is a phantom of the actual user data, hence the name -- phantom token . The app presents the token to the NGINX gateway according to the Bearer Token Usage specficiation (i.e., RFC 6750). This standard says that the app should send the phantom token in the Authorization request header. Once the NGINX se","default_branch":null,"files":null,"tree":[],"storefront":"/r/curityio","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/curityio/nginx_phantom_token_module/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}