Tim Anderson

I have a ClientRegistrationRepository implementation that stores ClientRegistrations in a database; these may change at runtime. In my case, I ran decode() with one version of a ClientRegistration, changed it,...

The client id is user configurable at runtime, in order to support integration with multiple email providers via oauth2. I was documenting the process and found that when I used...

That might work. In order to use it, the caller would need to keep their own cache of ClientRegistration instances and synchronise access e.g.: public class MyTokenDecoderFactory extends OidcIdTokenDecoderFactory {...

To be honest, I don't think it should cache at all; a JwtDecoderFactory wrapper could be used instead to provide caching. I don't feel strongly about it however, and your...