How do identity server validate the token at API or when we use Authorize attribute?

Question

I am using Identity server 4 as identity provider.

After getting the token for a successful login, we pass this token to the resource server.

My question is how does the Identity Server provider at the resource server end validate the submitted token ?

When I observed the traffic using fiddler I didn't see any request submitting the token to the provider to check.

Which means Identity Server provider at the resource server end itself is validating the token ?

Then why do we need to provide Authority when it is not checking against it?

How does the identity server provider at resource end make sure it is issued by a valid token provider ?

Answer 1

The resource server will not send the token over the wire to the identity provider to validate a token. This would incurr quite an overhead to your resource server.

Instead the resource server pulls down (and might cache) your identiy providers discovery document located at {identityserverUrl}./well-known/openid-configuration. This document contains materials that allow the resource server to validate the token within its own context. This is ofcourse assuming that the token is an access_token (issuer,jwks_uri)

If your resource server is using something like JwtBearerAuthentication middleware or IdentityServer4.AccessTokenValidation middleware, these things will do that for you.

Answer 2

JWT tokens are self-contained, and do not need a round-trip to verify that they are still valid with each use ... they are valid so long as they haven't expired, providing they haven't been tampered with which only involves signature checking.

You can set your client up though to request reference tokens (and set up your API to accept them), and these tokens will involve a round-trip every time they are used. You have the ability then to revoke tokens, which you can't do with JWTs.