Add token_prefixes

[ludydoo]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

Hello there!

This is a feature request to enable adding prefixes to tokens that ory hydra generates, in order to distinguish the token type without having to call the introspection endpoint, and to keep access tokens opaque.

https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/
https://api.slack.com/authentication/token-types
https://stripe.com/docs/api/authentication

Describe your ideal solution

An option in the configuration to specify the prefixes for each token type

token_prefixes:
  access_token:  acme:oac:
  id_token:      acme:oid:
  refresh_token: acme:orf:

Workarounds or alternatives

None that I could find, apart from modifying the source code

Version

Latest

Additional Context

The reason for this feature request is because we will need to generate other types of tokens than OAuth tokens. Our policy enforcement endpoint would need to verify the inbound request token.

For example, given these token types

• oa: (oauth token issued by hydra)
• or: (oauth refresh token issued by hydra)
• oi: (oauth id token issued by hydra)
• pat: (personal access token issued by my-pac-service)
• mt: (machine token issued by my-admin-service)

The policy enforcement endpoint would need to distinguish which service to call for the token introspection.

If the tokens were prefixed, it would be very easy to call the appropriate service to verify the token. That could even be done eg. Envoy ext_authz, with a route matcher.

Sample logic

func VerifyAuthHeader(authorizationHeader string){
  if strings.HasPrefix(authorizationHeader, "Bearer oa:"){
    // call hydra admin token introspection 
  }
  if strings.HasPrefix(authorizationHeader, "Bearer pat:"){
    // call my-pac-service
  }
}
...

[aeneasr]

Thank you for the idea! Please note that this will only work for opaque tokens, so when not using the JWT strategy. It will also not work for ID tokens!

But for refresh and access tokens this could work :)

[aeneasr]

done in v2

[rdfirtal]

Will token prefixes become configurable like OP suggests?

[aeneasr]

no!

[NickUfer]

What is the reason for not making these configurable except for everybody knowing ory hydra is used?

[aeneasr]

ory/fosite#733 (comment)