Careeroza

Opaque Tokens and Introspection

When to Use Them

Use opaque tokens when you need instant revocation (a bank logging out a stolen phone) or do not want token contents readable by clients. The API asks the authorization server about each token (RFC 7662 introspection).

application.yml

spring:
  security:
    oauth2:
      resourceserver:
        opaquetoken:
          introspection-uri: http://localhost:8180/realms/shopease/protocol/openid-connect/token/introspect
          client-id: order-service
          client-secret: ${ORDER_SERVICE_SECRET}
http
    .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
    .oauth2ResourceServer(oauth2 -> oauth2.opaqueToken(Customizer.withDefaults()));

What Introspection Returns

Introspection

curl -s -u order-service:$ORDER_SERVICE_SECRET \
  -d token=$TOKEN http://localhost:8180/realms/shopease/protocol/openid-connect/token/introspect

Example output

{
  "active": true,
  "sub": "9b1d2c3e-41f5-4a6b-8c7d-0e1f2a3b4c5d",
  "username": "asha",
  "client_id": "shopease-web",
  "scope": "openid orders.read",
  "exp": 1772340300,
  "token_type": "Bearer"
}

# after logout or revocation
{ "active": false }

Note: Every request now costs a network call. Cache results for a few seconds, or prefer short-lived JWTs (5 minutes) plus refresh-token revocation — that is what most e-commerce APIs do.