Bound cache use and account for revocation
05Caching can reduce introspection traffic, but the cached state can become stale if a token is revoked before the cache is refreshed.
At t+20 the example fetches a fresh response and learns active false. Reusing the original active-true result at t+30 would exceed the expiration limit.
Source for this drawing: RFC 7662 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- TTL
- A chosen cache time-to-live; it cannot override an earlier token expiration.
- Liveness
- How current the information is when used for a decision.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A protected resource MAY cache introspection responses. System designers MUST consider the performance/security trade-off of using cached authorization information.
- A protected resource MAY cache introspection responses. System designers MUST consider the performance/security trade-off of using cached authorization information.
- A longer cache lifetime reduces requests but can allow stale active information after revocation. Sensitive deployments can disable caching at the cost of more traffic and server load.
- If exp is present, the response MUST NOT be cached beyond that time. An application’s shorter cache policy can require refreshing earlier; exp is an upper bound, not a recommended TTL.
- Introspection conveys token state. It does not itself revoke the token or guarantee a push notification invalidates every cached result immediately.
Worked example: fetchedAt2000000000, chosen TTL30 seconds, exp2000000020. The latest permitted cache boundary is min(fetchedAt+TTL, exp), so20 seconds, not30. Revocation after10 seconds creates a possible stale window until refresh or that bound; it is not a recommended10-second exposure. The t+20 refresh shown obtains active false. Local authorization policy still applies even when a cached result says true.
Read the RFC section ↗