Adding Business Logic to Your Tokens - What Could Possibly Go Wrong

This talk examines the practical limits and risks of adding business claims to access tokens. It follows a production case involving token validation, oversized cookies, and API gateway errors.

Syllabus

Introduction
About Linda
Lost Puppy Project
Key Tips
Basic Access Token
What happened when I took over
Picking a token
Reading the RFC
Token Scopes
Creating an Identity Server
Testing API
What could possibly go wrong
Application ID
API
Security Token Validator
Cookies
Max cookie size
Cookie Chunky Manager
Kong has limits
Kong has a big head
We cant get rid of them
Kong error fix
Removing the token
Why was this a problem
Two minds
Undocumented endpoints
Time
Story
Why do we have 14day access tokens
Recap
Love your puppy project
Lunch