Securely preserving prior security tokens for recall
An approach for optimizing security token exchange. The approach receives a first request from a client. The approach extracts a first security token and an API reference. The approach validates the first security token. If the security token is valid, then the approach, calls the API and retrieves a second security token, embeds the second security token in the API and sends a second request with a third security token and the reference to the API to another application in a different domain.
1. A computer-implemented method for optimizing security token exchange associated with a plurality of domains, the computer-implemented method comprising:
receiving, by one or more processors, at a second service in a second domain, a first request from a client in a first domain;
extracting, by the one or more processors, a second security token, associated with a security service in the second domain, and a reference to a first application programming interface (API) from one or more APIs associated with the first request;
validating, by the one or more processors, the second security token at the second security service, wherein the second security token contains a second bearer header;
responsive to the second security token being valid, executing actions comprising:
retrieving, by the one or more processors, a first security token, associated with the first domain, based on a call to the first API, wherein the first security token contains a first bearer header;
embedding, by the one or more processors, the second security token in a second API; and
sending, by the one or more processors, a second request comprising a third security token and the reference to the second API from one or more APIs to a third service in a third domain;
responsive to the second security token not being valid, sending, by the one or more processors, a reply to the client in the first domain denying the first request;
validating, the third security token from a third request, wherein the third security token is retrievable with a third API from one or more APIs, wherein the third security token contains a third bearer header; and
storing an exchange history associated with, at least, the first security token, the second security token and previous security tokens, wherein a token reference comprises of, a resource identification based on the exchange history or URL (uniform resource locator) associated with the exchange history.
2. The computer-implemented method of claim 1 , wherein the security token is a JavaScript Object Notation (JSON) Web Token (JWT).
3. The computer-implemented method of claim 1 , wherein the one or more APIs is a uniform resource locator (URL) to an API.
4. The computer-implemented method of claim 1 , wherein the retrieving further comprises the exchange history associated with the first security token.
5. The computer-implemented method of claim 1 , wherein the one or more APIs is a resource identifier if a host associated with the one or more APIs is also the host associated with a token issuer.
6. The computer-implemented method of claim 3 , wherein the validating further comprises:
matching, by the one or more processors, an URL associated with a request to an URL embedded in a security token.
7. The computer-implemented method of claim 1 , wherein the call to the one or more APIs further comprises providing credentials that are valid to allow access to the one or more APIs.
8. A computer program product for optimizing security token exchange associated with a plurality of domains, the computer program product comprising:
one or more non-transitory computer readable storage media and program instructions stored on the one or more non-transitory computer readable storage media and executed by one or more processors, the program instructions comprising the steps of:
receiving at a second service in a second domain, a first request from a client in a first domain;
extracting a second security token, associated with a security service in the second domain, and a reference to an application programming interface (API) associated with the first request;
validating the second security token at the second security service, wherein the second security token contains a second bearer header;
responsive to the second security token being valid, executing actions comprising:
retrieving a first security token, associated with the first domain, based on a call to the API, wherein the first security token contains a first bearer header;
embedding the second security token in the API; and
sending a second request comprising a third security token and the reference to the API to a third service in a third domain;
responsive to the second security token not being valid, sending, a reply to the client in the first domain denying the first request;
validating, the third security token from a third request, wherein the third security token is retrievable with a third API from one or more APIs, wherein the third security token contains a third bearer header; and
storing an exchange history associated with, at least, the first security token, the second security token and previous security tokens, wherein a token reference comprises of, a resource identification based on the exchange history or URL (uniform resource locator) associated with the exchange history.
9. The computer program product of claim 8 , wherein the security token is a JavaScript Object Notation (JSON) Web Token (JWT).
10. The computer program product of claim 8 , wherein the one or more APIs is a uniform resource locator (URL) to the one or more APIs.
11. The computer program product of claim 8 , wherein the retrieving further comprises the exchange history associated with the first security token.
12. The computer program product of claim 8 , wherein the one or more APIs is a resource identifier if a host associated with the one or more APIs is also the host associated with a token issuer.
13. The computer program product of claim 10 , wherein the validating further comprises:
matching, by the one or more processors, an URL associated with a request to an URL embedded in a security token.
14. The computer program product of claim 8 , wherein the call to the one or more APIs further comprises providing credentials that are valid to allow access to the one or more APIs.
15. A computer system for optimizing security token exchange associated with a plurality of domains, the computer system comprising:
one or more computer processors;
one or more non-transitory computer readable storage media; and
program instructions stored on the one or more non-transitory computer readable storage media, the program instructions comprising the steps of:
receiving at a second service in a second domain, a first request from a client in a first domain;
extracting a second security token, associated with a security service in the second domain, and a reference to an application programming interface (API) associated with the first request;
validating the second security token at the second security service, wherein the second security token contains a second bearer header;
responsive to the second security token being valid, executing actions comprising:
retrieving a first security token, associated with the first domain, based on a call to the API, wherein the first security token contains a first bearer header;
embedding the second security token in the API; and
sending a second request comprising a third security token and the reference to the API to a third service in a third domain;
responsive to the second security token not being valid, sending, a reply to the client in the first domain denying the first request;
validating, the third security token from a third request, wherein the third security token is retrievable with a third API from one or more APIs, wherein the third security token contains a third bearer header; and
storing an exchange history associated with, at least, the first security token, the second security token and previous security tokens, wherein a token reference comprises of, a resource identification based on the exchange history or URL (uniform resource locator) associated with the exchange history.
16. The computer system of claim 15 , wherein the security token is a JavaScript Object Notation (JSON) Web Token (JWT).
17. The computer system of claim 15 , wherein the one or more APIs is a uniform resource locator (URL) to one or more APIs or a resource identifier if a host associated with the one or more APIs is also the host associated with a token issuer.
18. The computer system of claim 15 , wherein the retrieving further comprises the exchange history associated with the first security token.
19. The computer system of claim 17 , wherein the validating further comprises:
matching, by the one or more processors, an URL associated with a request to an URL embedded in a security token.
20. The computer system of claim 15 , wherein the call to the one or more APIs further comprises providing credentials that are valid to allow access to the one or more APIs.