Resource Indicators for OAuth 2.0
Resource Indicators for OAuth 2.0 (RFC 8707, Proposed Standard, February 2020) define a resource request parameter a client sends to the authorization server to name the API it intends to call, so the server can audience-restrict the access token to that API.
Without a resource indicator, one access token often works at every API that trusts the same authorization server, so a token leaked from, or deliberately replayed by, a low-value service opens high-value ones. RFC 8707 closes that by letting the token's audience say exactly which resource server may accept it, and the resource server must reject tokens minted for someone else. The Model Context Protocol requires MCP clients to send the resource parameter in both authorization and token requests for this reason: a malicious MCP server must not be able to replay a user's token at another server. Audience checks only help if resource servers actually enforce them, which is the step most often skipped.
See also: access token, scope, MCP authorization, protected resource metadata, bearer token, token replay against unbound endpoints, cross-tenant token confusion
Related on Start with Identity
- GlossaryOAuth 2.0
OAuth 2.0 is the standard authorization framework for delegated access. It lets a client obtain limited access to a resource owner's data without handling their
- GlossaryOAuth 2.0 Authorization Server Metadata
OAuth 2.0 Authorization Server Metadata ([RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), Proposed Standard, June 2018) is a JSON document an authorization s
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz
- BlogConsentFix: hijacking Microsoft 365 through the OAuth consent flow
ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks t
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still