Pluggable Token Handling

[esatterwhite]

Particularly in the case of opaque tokens, It would be great to be able to include the token management as a part of the adapter or some other swappable mechanism. We have a system for managing tokens, and we don't wish to change that. In utilizing this library, it doesn't seem there is a way to define a new token type or control how one is generated.

Ideally, this library should allow implementers to define how a token format is defined and managed.

[panva]

Please extend your thought considerably, as is there isn't enough to go off of. As per https://github.com/panva/node-oidc-provider/discussions/new?category=ideas

Only fully-fledged ideas with description, examples and clearly stated "why" or "what for" stand a chance of being discussed, otherwise they will be closed and eventually removed.

[panva]

Help me to understand the resistance to the idea in general

Don't interpret my suggestions to use that which is already there as resistance.

Can be identified by Security scanners / SAST tools

I think that's a neat idea there to be able to define an opaque token prefix such as op_at_${value} for Access Tokens, Refresh Tokens, Authorization Codes, Device Codes, CIBA Requests. At the same time I'd think of a MAC digest of the prefix and value as part of the issued opaque value.

[esatterwhite]

At the same time I'd think of a MAC digest of the prefix and value as part of the issued opaque value.

We have a bit of both. We have an identifiable prefix of different token types, we HMAC either a random value, or some user supplied key, and include a crc33 hash. Then keep a checksum so the public tokens are never actually persisted. Which is important for various compliance reasons at our company.
This, in addition to a tiered and mailable acl system.

There are quite a number of reasons to be in control of the management of the tokens themselves.

[esatterwhite]

What else would be needed for this to become a concrete feature?

[weyert]

Looks like a nice idea!

[esatterwhite]

@panva just checking back here. What would it take to push this forward?