Safety of Adding Fields to Access Token

Help
1

I’m adding the organization name to my access token in a rule:
context.accessToken[namespace + 'org_name'] = context.organization.name.

This works, but I’m curious about the security aspect. Can this custom field be tampered with on the user side? Or is it encrypted in the same way as the default fields that are normally on the access token?

2

Hi @arun2

The access token is signed, and the signature includes all claims including custom claims. Tampering with a custom claim will invalidate the signature.

As long as you properly verify the access token, you are good.

John

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.