Adding Business Logic to Your Tokens - What Could Possibly Go Wrong

Explore the potential pitfalls of adding business logic to tokens in this 48-minute conference talk from NDC Conferences. Learn about the differences between ID tokens and access tokens, and understand the risks associated with adding numerous claims related to business logic. Discover the limitations and security concerns that arise from overloading tokens with excessive information. Follow the journey of the "Lost Puppy Project" to gain insights into best practices for token management. Examine the process of creating an Identity Server, testing APIs, and handling token validation. Delve into practical issues such as cookie size limitations, Kong gateway constraints, and the challenges of undocumented endpoints. Gain valuable knowledge on balancing convenience and security when working with tokens in identity management systems.