# KeyCloak Access Token data Encryption

**URL:** <https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138>\
**Category:** Securing applications\
**Created:** [October 15, 2019, 8:13pm UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138 "2019-10-15T20:13:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulogervas](https://avatars.discourse-cdn.com/v4/letter/p/eb8c5e/32.png) [@paulogervas](https://forum.keycloak.org/u/paulogervas)\
**Post date:** [October 15, 2019, 8:13pm UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138/1 "2019-10-15T20:13:02Z")

</div>

Hi, all!

Its my first post here! I hope to have collaborate with you with my doubts and answers.

I have a doubt using access tokens gererated a access\_token with the data:

> {  
> “jti”: “cdfdc923-79c4-4442-8655-591a2cde9a45”,  
> “exp”: 1570806211,  
> “nbf”: 0,  
> “iat”: 1570805911,  
> **“iss”: “[http://localhost:8080/auth/realms/poc2-realm](http://localhost:8080/auth/realms/poc2-realm)”,**  
> **“sub”: “445f77f3-140e-48b7-9ddf-5e912b7e7008”,**  
> “typ”: “Bearer”,  
> “azp”: “poc2-client”,  
> “auth\_time”: 0,  
> **“session\_state”: “f82bec67-6c6a-4c3c-92d4-e8bc566aba14”,**  
> “acr”: “1”  
> },  
> “scope”: “profile email”,  
> “email\_verified”: true,  
> “preferred\_username”: “poc2-user”  
> }

My problem is that the fields like: iss, session\_state between others; Cannot be exposed to the final client, because in my company point of view these data are very sensible.

I would like to encrypt these data, and present to the user something like:

{  
my-token:[_tuple above encrypted here_]  
}

Are there some function in keyCloak that realizes this task?

Thanks.  
Paulo.

---

<div class="post-metadata">

**Author:** ![simonpayne](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@simonpayne](https://forum.keycloak.org/u/simonpayne)\
**Post date:** [October 16, 2019, 5:46am UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138/2 "2019-10-16T05:46:43Z")

</div>

hi Paulo,

the client must know the value of iss otherwise they will not be able to direct traffic to keycloak to generate the token in the first instance?

when you say ‘final’ client, it sounds like client side you are passing the access token to client of origins unknown to keycloak and/or your resource server. if your iss is so sensitive that this is deemed insecure, is giving them the access token in the first place a good practice?

Simon.

---

<div class="post-metadata">

**Author:** ![paulogervas](https://avatars.discourse-cdn.com/v4/letter/p/eb8c5e/32.png) [@paulogervas](https://forum.keycloak.org/u/paulogervas)\
**Post date:** [October 16, 2019, 10:49am UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138/3 "2019-10-16T10:49:12Z")

</div>

Hi Simon, thanks for the answer.

When you said:

> the client must know the value of iss otherwise they will not be able to direct traffic to keycloak to generate the token in the first instance?

Currently not because these data (like realm and keycloak urls), could be stored in a gateway or in a config service in the server side.  
Keycloak is not queried directly by the final client and not has endpoints exposed publicly.

And when you said:

> is giving them the access token in the first place a good practice?

My guessing is that the access\_token with _roles_, _iss_, _sub_ and other ‘sensitive’ data exposed to ‘final client’ seems not a good solution.

I am thinking in a solution that delivery to the ‘final client’ a kind of token that any service inside server-side structure sends a request using this token to keycloak it convert it in an access\_token.  
So the access\_token will traffic only inside the server-side ecosystem.

My question is if Keycloak has a functionality or resource to delivery a token with no sensitive data that could be translated to the real access token.

Thanks.  
Paulo

---

<div class="post-metadata">

**Author:** ![hellschwarz](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/hellschwarz/32/72_2.png) [@hellschwarz](https://forum.keycloak.org/u/hellschwarz)\
**Post date:** [October 16, 2019, 11:14am UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138/4 "2019-10-16T11:14:05Z")

</div>

You could move the authentication from the user-facing frontend application to the backend that serves the frontend app, e.g. using `keycloak-node-connect` for an express server, thus the user will only get a cookie with a `connect.sid` entry, while credentials are managed in server-side sessions and never forwarded to the user agent.

---

<div class="post-metadata">

**Author:** ![Himay45](https://avatars.discourse-cdn.com/v4/letter/h/a4c791/32.png) [@Himay45](https://forum.keycloak.org/u/Himay45)\
**Post date:** [January 27, 2024, 5:41am UTC](https://forum.keycloak.org/t/keycloak-access-token-data-encryption/138/5 "2024-01-27T05:41:44Z")

</div>

@paulogervas Hi, I was wondering if you have found any solution for access token data encryption in Keycloak?