If an administrator removes a user’s role after an application has cached an allow decision, that user may keep access until the cache is refreshed or invalidated. The cache records a decision made from earlier state; it does not, by itself, prove the request is permitted now.
What a cached authorization decision actually means
Authentication establishes or uses credentials to identify a subject. Authorization decides whether that subject may perform a particular action on a resource. A valid token can help establish identity or carry claims, but token validity alone does not answer every application-level permission question.
As an Amazon Associate I earn from qualifying purchases.
An authorization result is based on relevant state at decision time: the subject, requested action and resource, applicable policy, and any attributes or entitlements used by the policy. A cache hit means the system is reusing an earlier result. Whether that result is still acceptable depends on how the underlying state can change and the freshness rules the system enforces. NIST defines authorization in terms of permission or right to access a resource: NIST authorization glossary.
Token introspection caching creates a revocation window
OAuth token introspection lets a protected resource ask an authorization server whether a token is active and receive associated information. Caching that response can reduce network traffic and server load, but it also delays recognition of changes. RFC 7662 states: “This creates a window during which a revoked token could be used at the protected resource.” The size of that window depends on the cache policy and invalidation behavior; it is not a promise that the token remains permitted for that duration. See RFC 7662, Section 2.
#1 Best Overall
RFC 7662 does not prescribe one universally safe cache lifetime. It says the acceptable duration depends on the protected resource’s sensitivity and the likelihood of token revocation or invalidation. It also says a cached introspection response containing an exp value must not be retained beyond that time. Highly sensitive resources can disable caching, trading the reduced stale-status risk for more network traffic and server load.
This is distinct from caching the protected application response itself. An introspection cache stores token status or related introspection data; an application or intermediary cache may store the actual protected content. Each has a separate boundary: fresh token status does not automatically make a previously cached content response safe to return, and fresh content caching does not prove the requester is authorized.
Policies and attributes can become stale as well
Token status is only one input to many authorization systems. A policy may change, a user may leave a group, an administrator may remove an entitlement, or an attribute used in an access rule may be updated. If those inputs are locally cached, a decision can remain based on old data even when the token itself is unexpired or has been checked again.
NIST’s ABAC publication discusses the security implications of stale cached attributes; it is explanatory background rather than current normative guidance. OWASP’s authorization patterns guidance likewise warns that stale local revocation data may permit incorrect access. Treat token, policy, group, entitlement, and attribute freshness as distinct concerns rather than assuming one refresh updates them all. See NIST SP 800-162 and OWASP Authorization Patterns Cheat Sheet.
Choose an authorization approach by risk and operating constraints
The right design depends on how much revocation delay the resource can tolerate, how frequently state changes, what availability is required, and what happens when a decision service cannot be reached. These approaches have different trade-offs; none removes the need to define and enforce freshness.
| Approach | Freshness and revocation | Availability and load | Invalidation and failure behavior | State evaluated or cached |
|---|---|---|---|---|
| Introspect on each request | Checks token status with the authorization server for each request, avoiding an introspection-response cache window when the server’s answer is current. | Adds a network dependency, request load, and latency to authorization checks. | Revocation can be reflected on a subsequent successful check; define deny behavior for timeout or error. | Token active status and any information returned by introspection; application policy and attributes may still be separate. |
| Bounded introspection-response cache | Can continue using an earlier active response until expiry or invalidation, so revocation recognition is delayed by the cache policy. | Reduces introspection traffic and avoids a remote call on every cache hit. | Requires reliable expiry and, if used, reliable invalidation propagation; a failed refresh needs an explicit fail-closed or other risk-approved policy. | Cached introspection response, including active status and returned fields. |
| Locally evaluated policy | Can decide without a remote policy call, but changes to local policy, revocation data, or attributes must reach the evaluator to affect decisions. | May avoid per-request remote decision latency, while making availability and consistency depend on local deployment and update mechanisms. | Requires a plan for distributing changes and handling stale local state; OWASP advises denying protected operations when the policy decision point errors or times out. | Local policy and the token, attributes, or revocation information supplied to the evaluator. |
OWASP describes embedded, sidecar, and remote policy-decision approaches and notes their differing availability and freshness considerations. The table is a design comparison, not a guarantee for every implementation: actual behavior depends on the system’s refresh, replication, timeout, and invalidation mechanics.
Set a freshness policy before choosing a cache lifetime
Do not choose a duration simply because it is convenient or common elsewhere. Set an explicit maximum age by considering the following factors:
Recommended Free Tools
- Resource sensitivity: A permission delay that might be tolerable for low-impact content can be unacceptable for a highly sensitive operation.
- Acceptable revocation delay: Decide how long a revoked token, removed role, changed policy, or updated attribute may continue to affect access.
- Change frequency: Frequent invalidations increase the chance that cached state will lag a meaningful change.
- Online-check cost: Account for authorization-service latency, request volume, and load when deciding whether to check every request or cache bounded responses.
- Failure behavior: Specify what happens on timeouts, errors, and unavailable dependencies. OWASP recommends denying protected operations when the policy decision point errors or times out.
- Invalidation and versioning: Determine whether changes can reliably invalidate entries across processes, replicas, and regions, or whether policy and attribute versions can be checked.
RFC 7662’s guidance is risk-based rather than numeric: the appropriate validity period depends on resource sensitivity and the likelihood of revocation or invalidation. Make the selected lifetime an explicit policy decision, and ensure it never extends beyond an introspection response’s exp value.
Best Value
Protect cached application responses separately
Returning cached protected content is an authorization decision too. OWASP’s Web Cache Security guidance recommends authorizing the current request before serving cached application data. It also advises making cache keys account for every input that can change the response, or rejecting such inputs, and setting explicit cache controls. A correct token-introspection cache does not substitute for these safeguards.
- Run the current authorization check before returning protected cached content.
- Include identity, tenant, resource, and other response-changing inputs in the cache key, or prevent those inputs from varying the response.
- Set explicit cache directives appropriate to the data and the caches that may handle it.
- Test the real production cache path with different users and tenants, including requests immediately after access changes.
- Plan how cached responses and authorization entries are invalidated when permissions change.
See the OWASP Web Cache Security Cheat Sheet.
Implementation checks for a safer cache
- Define the cached object. Document whether the cache holds token-introspection data, a policy decision, attributes, or protected response content. Each object has its own freshness boundary.
- Set a maximum age and expiry rule. Choose a maximum age based on the revocation delay acceptable for the resource. Do not cache an introspection response beyond its
expvalue. - Authorize the current request where content is cached. Do not treat a cached application response as proof of current permission.
- Separate identities and tenants. Ensure cache keys cannot let one subject or tenant reuse another’s authorization decision or response.
- Exercise revocation and change paths. Test token revocation, role removal, policy changes, attribute updates, timeout, and cache invalidation through the same production path used by requests.
- Define error behavior. Decide whether each protected operation denies access when its authorization dependency cannot provide a current decision; avoid silently converting an error into an allow.
- Log decision context safely. Record enough to understand which policy or state version informed a decision and when it was made, while keeping secrets and sensitive tokens out of logs.
When should a cached allow be rejected?
If the system cannot establish that the cached entry is still within the freshness policy for the relevant token, policy, and attributes, it should not treat that entry as current permission. Refresh, invalidate, or deny according to the resource’s defined failure policy. A cache is an optimization of an authorization process, not a replacement for deciding whether the present request is allowed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
