Securing User Access Token

While the Wallaby access token directly authorizes the device to use our system, the user access token indirectly authorizes the end user to access our system. Instead of Wallaby validating the end user directly, it instead trusts your application's native auth to do so.

The benefit of this design is that

1. we avoid duplicate auth inputs such as multiple authenticator codes, biometric inputs, texts, etc.

2. you have the flexibility to determine your own security requirements based on the types of assets expected to be held by end users

Security Requirements

According to this model, you will need to sign this access token after you successfully authorize the user. In general, we recommend

1. that the signing require a reasonable MFA method either before or after the authorization

2. that the signing take place server side

3. that the token have a reasonable expiration time

Reasonable depends on the value of assets expected to be held. If those assets are high value, 30 minutes is recommended and the MFA should be a biometric or TOTP.