New to Auth0. I’m designing an architecture with a gateway service that should decode and validate Auth0 user data before forwarding the request to other the services.
I’ve tried building on the provided python example, There, the client eventually saves a secure session cookie and sends it to following calls. Decoding it is normally done using the Python library. But that assumes the client calls the services directly and requires implementing the decode logic in every service.
How do I decode this cookie (without the Auth0 library) so I can extract and forward the id_token for example in the gateway? If I use the python example - Is this encrypted cookie using an algorithm I can implement without the library? Perhaps by some standard gateway middleware?
I’m currently using Envoy proxy as a gateway and OPA for authorization. They both have decryption tools, I’m just not sure what the structure of the session cookie is, and if this is a reasonable approach at all.
Thanks.