https://sauvikbiswas.com/tags/jwt/ Recent content in Jwt on Sauvik Biswas Hugo en-us Wed, 17 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-06b/ Wed, 17 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-06b/ <h2 class="heading" id="why-a-second-validation-mode"> Why a second validation mode <a class="anchor" href="#why-a-second-validation-mode">#</a> </h2> <p><a href="https://sauvikbiswas.com/posts/learning-oauth-2-06/">v06</a> split the authorization server from the resource server and taught the default way a separate resource server trusts a token it never issued: <strong>introspection</strong> (Mode A). On every <code>GET /api/me</code>, the resource server sends the opaque Bearer token to <code>POST /introspect</code> on the auth server and gets back <code>active</code>, <code>sub</code>, and <code>exp</code>.</p> <p>That works, but it has a cost: a network hop to the auth server on every single API call, and a hard dependency — if the auth server is down, <code>/api/me</code> fails even when the client still holds a perfectly valid token.</p>