Risk Assessment - Githubissues

TTT-WG / TTT-WG

Repository for the Token Trust and Traceability Working Group

1 stars 0 forks source link

Open mdoidge opened 2 months ago

mdoidge commented 2 months ago

Risk is very variable, depending on the power of the tokens.

msalle commented 2 months ago

Just a brain dump of several factors, not all orthogonal:

which type of token (IETF/OIDC: access, refresh, id token, "R&E": mytoken, vault)
who can use the token (ordinary user/browser, limited clients with authN, ...)
where can the token go and be used (bearer, audience)
lifetime of the token
how is it verified (can the token be revoked, offline verifiable, only online)