Sending sensitive information with OAuth Bearer Tokens using asp.net claims

Question

I am adding sensitive information into a OAuth Bearer Token using asp.net claims. The token is generated by wep api and sent by the client to api for every request.

Here is the function that generates the token

public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            using (var applicationDb = new ApplicationDbContext())
            using (var userStore = new UserStore<AppUser>(applicationDb))
            {
                IApplicationUserService applicationUserService = new ApplicationUserService(userStore, null, null, null);
                try
                {
                    var appUser = await applicationUserService.AuthenticateUserAsync(context.UserName, context.Password);

                    if (appUser == null)
                        context.SetError("InvalidCredentials", "The email or password that you entered is incorrect.");
                    else if (!appUser.EmailConfirmed)
                        context.SetError("EmailVerification", "You must verify your email address before signing in.");
                    else
                    {

                        var roles = applicationUserService.GetUserRoles(appUser.Id);
                        var identity = new ClaimsIdentity(context.Options.AuthenticationType);
                        identity.AddClaim(new Claim(ClaimTypes.UserId, appUser.Id));
                        identity.AddClaim(new Claim(ClaimTypes.Roles, string.Join(",", roles.ToArray())));

                        context.Validated(identity);
                    }
                }
                catch (Exception exception)
                {
                    context.SetError("server error", "Server error! Please try again later.");
                }
            }
        }

        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            context.Validated();
        }

In the code above, I am adding userId and role claims to the token. I am using the roles to give access to specific information in the web API.

How safe is this approach? Can I trust the information in the token? can the user tamper with the token and change the role?

If so, how can I prevent from this? Should I be re-validating all information in the token with database?

score 0 · Answer 1 · edited May 23 '17 at 12:08

As long as the token is signed and the signature is valid, you should be ok. If a user tampered with the token, the signature would no longer be valid. Depending on the token type, this signing is done in various fashions. Here's a great article on the topic:

http://www.cloudidentity.com/blog/2014/03/03/principles-of-token-validation/

You might also find these threads useful:

Are OAuth2 bearer tokens signed?

How to validate an OAuth 2.0 access token for a resource server?

Sending sensitive information with OAuth Bearer Tokens using asp.net claims

1 Answers1