IdentityModel.AspNetCore.OAuth2Introspection icon indicating copy to clipboard operation
IdentityModel.AspNetCore.OAuth2Introspection copied to clipboard

Question: use an expired access token

Open ILoveCoding1100 opened this issue 2 years ago • 0 comments

Is it generally possible to cache an access token on a resource server, even if it may expire during that short period of continued usage, considering that there are no other resource servers involved and the token is only used for local operations such as database persistence?

I have to cache the Access Token for at least 5 minutes. At the same time, it is only valid for 30 minutes. If a user goes to the backend just before the access token expires (e.g. in minute 29), the invalid token is cached for another 4 minutes. So an invalid token will be used. For me it's okay because it's only some minutes. But is this any problem from a technical point of view?

This is my code:

builder.Services.AddAuthentication(OAuth2IntrospectionDefaults.AuthenticationScheme).AddOAuth2Introspection(options =>
                {
                    options.Authority = authority;
                    options.ClientId = clientId;
                    options.ClientSecret = clientSecret;
                    options.EnableCaching = true;
                    options.CacheDuration = TimeSpan.FromMinutes(5);
                });

                builder.Services.AddAuthorization();

ILoveCoding1100 avatar May 15 '23 14:05 ILoveCoding1100