             throw Abort(.forbidden)
         }
         
+        let tokenRequest = Request(method: .post, uri: tokenIntrospectionEndpoint)
+        var tokenRequestJSON = JSON()
+        try tokenRequestJSON.set("token", token)
+        
+        let tokenInfoResponse = try client.respond(to: tokenRequest)
+        
+        guard let tokenInfoJSON = tokenInfoResponse.json else {
+            throw Abort.serverError
+        }
+        
+        guard let tokenActive = tokenInfoJSON["active"]?.bool, tokenActive else {
+            throw Abort.unauthorized
+        }
+        
         return try next.respond(to: request)
     }
 }

        let remoteResourceController = RemoteResourceController(drop: resourceDrop)
        remoteResourceController.addRoutes()
        
        var authConfig = try Config(arguments: ["vapor", "--env=test --port=8082"])
        let newClient = OAuthClient(clientID: newClientID, redirectURIs: [redirectURI], clientSecret: clientSecret, validScopes: [scope, scope2], confidential: true, firstParty: true)
        let fakeCodeManager = FakeCodeManager()
        let clientRetriever = StaticClientRetriever(clients: [newClient])

        let userRequest = Request(method: .get, uri: "/user")
        userRequest.headers[.authorization] = "Bearer \(fakeTokenString)"
        
        let userResponse = try resourceDrop.respond(to: userRequest)
        
        XCTAssertEqual(userResponse.status, .ok)
        
