Token Validations by resource server

[sagarshah1983]

Hello everyone,
I am looking at writing a resource server application, which accepts the bearer access token in request header, so first thing it needs to do is validate the token by calling introspection endpoint on Hydra.
Can this approach be replaced using JWT token? Can that avoid a need for calling introspection endpoint in any way and let resource server still validate the token? Are there any pitfalls to be kept in mind here?

Only benefit i see with JWT, is we don't have to call introspect endpoint on Hydra to validate the token. However, does Hydra have anything to protect against brute-force?

[vinckr]

There are some considerations, are you planning to use Ory Oathkeeper as well?

[sagarshah1983]

Thanks for replying. We have not considered oathkeeper yet, as we have not finalized if JWT is the way to go for our scenarios.
We do need a capability to invalidate issued access tokens, if the consent is removed by the user at any point, or if we disable the client. So I think, if JWT cannot be revoked, we may have to go with opaque token and resort to introspection, but not certain, what happens if we are flooded with API calls with invalid tokens itself. Can it bring down Hydra in that case, is that possible? Are there any best practices to solve such a use case?

[vinckr]

Well, you can revoke them, but they will be considered valid until the "expiry" of the token is reached.
From the docs.

Going with opaque tokens would be easier, and you can use Ory Oathkeeper to convert them into jwt tokens for other services.

As for the other question, I am not sure. I believe that Ory Oathkeeper would be able to reject all those API calls with invalid tokens if someone were to be trying to attack you this way. Will clarify this 😺