Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Question: use an expired access token #178

Open
ILoveCoding1100 opened this issue May 15, 2023 · 0 comments
Open

Question: use an expired access token #178

ILoveCoding1100 opened this issue May 15, 2023 · 0 comments

Comments

@ILoveCoding1100
Copy link

ILoveCoding1100 commented May 15, 2023

Is it generally possible to cache an access token on a resource server, even if it may expire during that short period of continued usage, considering that there are no other resource servers involved and the token is only used for local operations such as database persistence?

I have to cache the Access Token for at least 5 minutes. At the same time, it is only valid for 30 minutes. If a user goes to the backend just before the access token expires (e.g. in minute 29), the invalid token is cached for another 4 minutes. So an invalid token will be used. For me it's okay because it's only some minutes. But is this any problem from a technical point of view?

This is my code:

builder.Services.AddAuthentication(OAuth2IntrospectionDefaults.AuthenticationScheme).AddOAuth2Introspection(options =>
                {
                    options.Authority = authority;
                    options.ClientId = clientId;
                    options.ClientSecret = clientSecret;
                    options.EnableCaching = true;
                    options.CacheDuration = TimeSpan.FromMinutes(5);
                });

                builder.Services.AddAuthorization();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

1 participant