IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

oauth token use after revocation

  • 1.  oauth token use after revocation

    Posted 08/06/20 10:27 AM
    I have an oauth definition defined and noticed that I can use an access token even though it's been previously revoked. 

    Is it best practice to always hit the introspection endpoint for any token communication to ensure it's still valid before allowing that token to be used? I would think this would introduce too much traffic to the introspection endpoint. But I'm not seeing any other way of doing this. I could of course set the token expiration to a very low value to minimize the chance it could get in the wrong hands and be used maliciously but that might not be an option in our case.

    Thanks,
    Scott

    ------------------------------
    Scott Reichardt
    10.0
    ------------------------------


Related Content