Invocation path security in distributed systems

One or more non-transitory computer storage media encoded with computer program instructions that when executed by a plurality of computers cause the plurality of computers to perform operations comprising:

• receiving, by an upstream application, a request from a user;
• based on the upstream application authenticating a user, receiving an initial token that represents the authenticated user;
• receiving, by a midstream application from the upstream application, a first invocation request, the first invocation request being associated with a first token generated by the upstream application, the first token including the initial token and the first token specifying a permissible audience of the first token, wherein the audience identifies recipients that the first token is intended for;
• authenticating, by the midstream application, the first invocation request, including verifying the first token of the upstream application and the initial token within the first token;
• verifying, by the midstream application, that the midstream application is an instance of the permissible audience of the first token;
• upon successful verification, generating, by the midstream application, a second token comprising the initial token;
• submitting, by the midstream application to a downstream application, a second invocation request in association with the second token and the first token;
• receiving, by the downstream application from the midstream application, the second invocation request;
• authenticating, by the downstream application, the second invocation request, including verifying the second token of the midstream application and the initial token within the second token;
• and
• verifying, by the downstream application, that the midstream application is an instance of the permissible audience for the first token received from the upstream application.

A system comprising one or more computers and one or more storage devices on which are stored instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising:

• receiving, by an upstream application, a request from a user;
• based on the upstream application authenticating a user, receiving an initial token that represents the authenticated user;
• receiving, by a midstream application from upstream application, a first invocation request, the first invocation request being associated with a first token generated by the upstream application, the first token including the initial token and the first token specifying a permissible audience of the first token, wherein the audience identifies recipients that the first token is intended for;
• authenticating, by the midstream application, the first invocation request, including verifying the first token of the upstream application and the initial token within the first token;
• verifying, by the midstream application, that the midstream application is an instance of the permissible audience of the first token;
• upon successful verification, generating, by the midstream application, a second token comprising the initial token;
• submitting, by the midstream application to a downstream application, a second invocation request in association with the second token and the first token;
• receiving, by the downstream application from the midstream application, the second invocation request;
• authenticating, by the downstream application, the second invocation request, including verifying the second token of the midstream application and the initial token within the second token;
• and
• verifying, by the downstream application, that the midstream application is an instance of the permissible audience for the first token received from the upstream application.