IdentityModel / IdentityModel.AspNetCore.OAuth2Introspection

ASP.NET Core authentication handler for OAuth 2.0 token introspection
Apache License 2.0
146 stars 67 forks source link

Question: use an expired access token #178

Open ILoveCoding1100 opened 1 year ago

ILoveCoding1100 commented 1 year ago

Is it generally possible to cache an access token on a resource server, even if it may expire during that short period of continued usage, considering that there are no other resource servers involved and the token is only used for local operations such as database persistence?

I have to cache the Access Token for at least 5 minutes. At the same time, it is only valid for 30 minutes. If a user goes to the backend just before the access token expires (e.g. in minute 29), the invalid token is cached for another 4 minutes. So an invalid token will be used. For me it's okay because it's only some minutes. But is this any problem from a technical point of view?

This is my code:

builder.Services.AddAuthentication(OAuth2IntrospectionDefaults.AuthenticationScheme).AddOAuth2Introspection(options =>
                {
                    options.Authority = authority;
                    options.ClientId = clientId;
                    options.ClientSecret = clientSecret;
                    options.EnableCaching = true;
                    options.CacheDuration = TimeSpan.FromMinutes(5);
                });

                builder.Services.AddAuthorization();