Managing tokens

As you learned from the previous section, tokens are usually bound to sessions. Therefore, the token validity – not necessarily their lifetimes – depends on sessions.

Tokens have their own lifetime and how long they are considered valid depends on how they are validated. By leveraging JSON Web Token (JWT) as a format for tokens, Keycloak enables applications to validate and inspect tokens locally without any additional roundtrip to the server. However, this capability has a consequence where tokens, although within their lifetime, might not be valid anymore if their sessions have expired.

Without taking this into account, you might end up in a situation where tokens are no longer valid (the sessions they are bound to have expired) but are still accepted by applications because they are within their lifetime, therefore increasing the attack surface if tokens are leaked. As you are going to learn in this section, you should always consider a clear...