Introspect token and get different userInfo

[Skander]

Hi,

I have two clients, the frontend is a public client, the backend is a bearer only client.
Is it possible to verify the token from the frontend and get more private attributes from userInfo that the frontend cannot see ?
Those attributes are created by an Admin REST API client and I don't want them to be seen by the public client.

Thank you

[piyush bakde]

hello,

I am Piyush, I am new to this open-source community and want to start with a contribution to open source. 

can anyone guide me with project installation and how to set up it on the local machine?

I went through the readme file and every detail of this project on GitHub but personally, I feel I should ask another member of the community so they can provide me a better guide to deal with it.

so what should I do after I cloned the project to my folder? 

[Martin Harm]

Hi,

yes, you can validate a token in the backend. Thats what token are for. 

and yes, you can pass an accesstoken from the frontend to the backend which than can use this token to call the userinfo endpoint, to get more information

BUT of course can the frontend call the userinfo with that token directly. So the extra informatin is not protected from the frontend.

Regards martin