title: Why caching access token is consider bad in oauth2?
body: <p>I am following this article for revoking user access :</p>
  
  <p><a href="http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/" rel="noreferrer">http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/</a></p>
  
  <p>Now consider after validating user I have issued an accesstoken with 30 minutes life span as shown in above article and with refresh token as 1 day but what if admin delete that user in 10 minutes with 20 minutes still left so now in this case I need to revoke access that user.</p>
  
  <p>In order to do this I need to remove that user entry from refresh token table to disallow further access token request but as accesstoken expire time is still having 20 minutes so user would be able to access protected resource which is completely wrong.</p>
  
  <p>So I was thinking to implement caching mechanism to <strong>cache the access token on server and also save in database</strong>. So when that user is revoked I can simply remove that user entry from cache and database to stop that user access from accessing protected resource.</p>
  
  <p>But this 2 below answers are saying this is not how oauth2 was designed : </p>
  
  <p><a href="https://stackoverflow.com/questions/27836338/revoke-access-token-of-oauthbearerauthentication/27848961#27848961">Revoke access token of OAuthBearerAuthentication</a></p>
  
  <p><a href="https://stackoverflow.com/questions/32655788/oauth2-unnecessary-complexity-with-refresh-token/32656180">OAuth2 - unnecessary complexity with refresh token</a></p>
  
  <p>So my question is  :</p>
  
  <p>1) Why caching access token is not considered better than refresh token mechanism and also a bad approach?</p>
  
  <p>My second question is based on this below answer given by <strong>@Hans Z.</strong> in which he is saying that :</p>
  
  <blockquote>
    <p>This necessarily would involve the Resource Server (RS) consulting the
    Authorization Server (AS) which is a huge overhead.</p>
  </blockquote>
  
  <p>2)  In case of revoking access for a user why does RS would consult AS because AS is just for authenticating user and generating access token as per this <a href="http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/" rel="noreferrer">Article</a>?</p>
  
  <p>3)  In the article there are only 2 projects :</p>
  
  <ul>
  <li><strong>Authentication.api</strong> - Authenticating user and generating access token</li>
  <li><p><strong>Resource server</strong> - validating accesstoken with the help of <code>[Authorize]</code>   attribute</p>
  
  <p>In above case which is the authorisation server then? </p></li>
  </ul>
  
  <p><strong>Update :</strong> I have decided to use refresh token to revoke user access in case user is deleted and also when user logout i will refresh token from refresh token table because of your requirement that we want to logout user immediately as soon as user clicks on logout.</p>
  
  <p>But here the problem is <strong>i have 250 roles associated with user so if i put roles in accesstoken then size of accesstoken will be so huge and we cannot pass such huge accesstoken from header</strong> but i cannot query roles for validating user access for endpoints each time that endpoint is called.</p>
  
  <p>So this is 1 another problem which i am facing.</p>