Study. uk . com
  1. Home
  2. All questions
  3. Question 349

CISSP study material · question 349 of 500

A developer asks whether an OAuth access token can be parsed by the client to read the granted scope. What does RFC 6749 say about token form?

  1. The string is usually opaque to the client, and may either be a handle the server looks up or carry the authorization inside it with a signature.
  2. The token is always an opaque handle that the resource server resolves by lookup.
  3. The token's format is fixed by the framework and identical across deployments.
  4. The token is always a signed structure the client is expected to parse.
Show the answer

Answer: A. The string is usually opaque to the client, and may either be a handle the server looks up or carry the authorization inside it with a signature.

RFC 6749 says the access token string is usually opaque to the client and may denote an identifier used to retrieve the authorization information, or self-contain that information verifiably.

Source: RFC 6749 (IETF) — RFC 6749 > 1.4 Access Token

Challenge yourself on this topic → Study as cards