             throw Abort(.forbidden)
         }
         
+        let tokenRequest = Request(method: .post, uri: tokenIntrospectionEndpoint)
+        var tokenRequestJSON = JSON()
+        try tokenRequestJSON.set("token", token)
+        
+        let tokenInfoResponse = try client.respond(to: tokenRequest)
+        
+        guard let tokenInfoJSON = tokenInfoResponse.json else {
+            throw Abort.serverError
+        }
+        
+        guard let tokenActive = tokenInfoJSON["active"]?.bool, tokenActive else {
+            throw Abort.unauthorized
+        }
+        
         return try next.respond(to: request)
     }
 }

    
    func addRoutes() {
        
        let oauthMiddleware = OAuth2Middleware(tokenIntrospectionEndpoint: "http://localhost:8082", requiredScopes: nil, client: drop.client)
        let protected = drop.grouped(oauthMiddleware)
        
        protected.get("protected", handler: protectedHandler)

        let userRequest = Request(method: .get, uri: "/user")
        userRequest.headers[.authorization] = "Bearer \(fakeTokenString)"
        
        let userResponse = try resourceDrop.respond(to: userRequest)
        
        XCTAssertEqual(userResponse.status, .ok)
        
