Application Security
OAuth2 / OIDC Resource Server
A Python API project documented to validate JWT access tokens and authorize requests through scopes and roles.
01
Problem and objective
The resource server is intended to protect API endpoints by validating access tokens from an authorization server and checking whether each token carries the required permissions.
02
Documented implementation
The repository describes a Flask API that checks JWT signatures using public keys from JWKS, validates issuer, audience, and time claims, and applies scope and role checks. Its documentation describes OAuth2-style 401 and 403 responses. Integration depends on configuration supplied by a separate authorization server.
03
What I learned
This project focuses on the API trust boundary: validate token properties before granting access, enforce permissions at the resource, and avoid logging bearer tokens.