{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/185","labels_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/185/labels{/name}","comments_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/185/comments","events_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/185/events","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/issues/185","id":119399685,"number":185,"title":"Use opaque access tokens by default and update the MVC sample to use the new validation middleware","user":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/labels/critical","name":"critical","color":"f7c6c7"},{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/milestones/4","html_url":"https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/milestones/1.0.0-beta5","labels_url":"https://api.github.com/repos/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/milestones/4/labels","id":1387359,"number":4,"title":"1.0.0-beta5","description":null,"creator":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":1,"state":"open","created_at":"2015-11-01T15:29:24Z","updated_at":"2015-11-30T00:33:29Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-11-30T00:33:29Z","updated_at":"2015-11-30T00:33:29Z","closed_at":null,"body":"Starting with ASOS beta5, we'll stop using JWT as the default format for access tokens and go back to opaque tokens (serialized by the data protection block), exactly like `OAuthAuthorizationServerMiddleware`. Of course, JWT tokens will still be supported, but will no longer be enabled by default (opting for JWT tokens for specific clients only will also be supported).\r\n\r\nSince ASP.NET 5 offers no native support for opaque tokens, I developed 2 new middleware:\r\n\r\n* An [introspection middleware] (https://github.com/aspnet-contrib/AspNet.Security.OAuth.Extensions/tree/vNext/src/AspNet.Security.OAuth.Introspection): as the name suggests, this middleware will use ASOS' introspection/validation endpoint to determine whether an access token is still valid and retrieve the corresponding authentication ticket. To avoid flooding the introspection endpoint, this middleware comes with native distributed/local cache support. Though primarily designed to work with ASOS, it can be used with virtually any OAuth2 server supporting the introspection RFC. Using this middleware is recommended if the resource server(s) is/are not in the same application as the authorization server. \r\n\r\n* A [validation middleware] (https://github.com/aspnet-contrib/AspNet.Security.OAuth.Extensions/tree/vNext/src/AspNet.Security.OAuth.Validation): this middleware is far simpler (and more efficient) than the introspection middleware as it directly decrypts the access token using the data protection block, instead of making an HTTP call to the authorization server. This middleware offers a much easier experience compared to `JwtBearerMiddleware` and `OAuthIntrospectionMiddleware` as it doesn't need any configuration by default but will only work if the resource servers and the authorization servers are part of the same applications or same the same data protection keys. Of course, this middleware is only designed to support the opaque tokens produced by the data protection block and doesn't natively support JWT tokens. For such tokens, `JwtBearerMiddleware` is still the best choice.\r\n\r\nThe MVC sample will be updated to reflect those changes."}}