Token throttling & cleanup

[leastprivilege]

braindump:

• for code flow: allow configurable amount of concurrent (non redeemed) code in the DB for subject/client combination.
• deny new codes

— reference tokens:

• optional upper limit of reference tokens per client/subject combination
• deny new tokens

— cleanup

• query if a token type exceeds the threshold (and tokens are still valid) - delete the expired ones?

[wiseman13]

I would also add having an option that would allow a user to manage reference tokens so that they could remove one to continue the current authorization. In my implementation based on a home rolled OAuth2 I also allowed the user to name the reference token to facilitate later removal.

[JoeFairchild]

Whatever became of this? Do you plan on doing token clean up, or is this something that's expected that it's done in the token service?