Hello everybody,

today I want to write a few words about security tokens in OAuth2. 

So, first of all I'd like to point that security tokens wasn't needed for corporate world. When I say corporate world, I mean networks like B2B, or B2E or something, that has strong system administration army.

But if you need to provide B2C or something like this than you'll need tokens.

As usually tokens has following features:

1. Security tokens are protected data structures
2. Also not prescribed in OAuth2 but quite often security tokens implemented as JSON web tokens
3. has information about producer and topic ( claims )
4. signed ( has some kind of identity proof )
5. as usually contain expiry date time

Security tokens have following life time:

1. Client requests token.
2. Producer creates token.
3. Resource which has trust relationship with producer consumes token.

Historically following tokens were already used:

1. SAML 1.1/2.0
   1. XML based
   2. encryption and signature options
   3. expressive
2. Simple web token ( SWT )
   1. Form/URL encoded
   2. Symmetric signatures only
3. JSON Web token ( JWT )
   1. JSON encoded
   2. symmetric and asymetric signatures ( HMACSHA256-384, ECDSA, RSA )
   3. symmetric and asymetric encryption ( RSA, AES/CGM )
4. Kerberos 
   1. used for corporate