虽然Owin WebAPI Bearer Token通过了

Question

I am using the OAuth bearer token authentication flow in my OWIN / web API / AngularJS application.

What I want to do is reuse the bearer token on the server and pass it on to a 2nd web API service (another service on another server which is also protected by bearer tokens and uses the same machine key). I know how to create a bearer token in C# and add it to the header of the request with HTTPClient - but how do I just use the bearer token I already have (passed in by the browser request)? is this possible?

Answer 1

Technically it is possible, but rarely a good idea. You would not normally pass it through, given that this would expose your backend API to man in the middle attacks. In the canonical approach you would use the access token you received to go back to the authority and request a new token, this time scoped for your backend. See https://github.com/Azure-Samples/active-directory-dotnet-webapi-onbehalfof for one example.