Managing tokens
As you learned from the previous section, tokens are usually bound to sessions. Therefore, the token validity – not necessarily their lifetimes – depends on sessions.
Tokens have their own lifetime and how long they are considered valid depends on how they are validated. By leveraging JSON Web Token (JWT) as a format for tokens, Keycloak enables applications to validate and introspect tokens locally without any additional roundtrip to the server. However, this capability has a consequence where tokens, although within their lifetime, might not be valid anymore if their sessions have expired.
Without taking this into account, you might end up in a situation where tokens are no longer valid but are still accepted by applications because they are within their lifetime, therefore increasing the attack surface if tokens are leaked. As you are going to learn from this chapter, you should always consider a clear strategy for token expiration and revocation...