feat: add possibility to ignore missing "exp" claim in introspection response for caching

Author: buehler

src/Infrastructure/CacheExtensions.cs

@@ -46,14 +46,16 @@ public static async Task<IEnumerable<Claim>> GetClaimsAsync(this IDistributedCac
         public static async Task SetClaimsAsync(this IDistributedCache cache, OAuth2IntrospectionOptions options, string token, IEnumerable<Claim> claims, TimeSpan duration, ILogger logger)
         {
             var expClaim = claims.FirstOrDefault(c => c.Type == JwtClaimTypes.Expiration);
-            if (expClaim == null)
+            if (expClaim == null && !options.CacheIgnoreMissingExp)
             {
                 Log.NoExpClaimFound(logger, null);
                 return;
             }
 
             var now = DateTimeOffset.UtcNow;
-            var expiration = DateTimeOffset.FromUnixTimeSeconds(long.Parse(expClaim.Value));
+            var expiration = expClaim == null
+                ? now + duration
+                : DateTimeOffset.FromUnixTimeSeconds(long.Parse(expClaim.Value));
             Log.TokenExpiresOn(logger, expiration, null);
 
             if (expiration <= now)
@@ -79,4 +81,4 @@ public static async Task SetClaimsAsync(this IDistributedCache cache, OAuth2Intr
             await cache.SetAsync(cacheKey, bytes, new DistributedCacheEntryOptions { AbsoluteExpiration = absoluteLifetime }).ConfigureAwait(false);
         }
     }
-}
+}

src/OAuth2IntrospectionOptions.cs

@@ -114,6 +114,12 @@ public OAuth2IntrospectionOptions()
         /// </summary>
         public string CacheKeyPrefix { get; set; } = string.Empty;
 
+        /// <summary>
+        /// If set, the caching mechanism will ignore missing "exp" claims in the
+        /// introspection response.
+        /// </summary>
+        public bool CacheIgnoreMissingExp { get; set; }
+
         /// <summary>
         /// Specifies the method how to generate the cache key from the token
         /// </summary>