Closed
Description
By default, Resource Server should be stateless. This is achieved in its JWT support via the @Transient
annotation:
@Transient
public class JwtAuthenticationToken
For introspection, it would be better if OAuth2IntrospectionAuthenticationToken
did the same thing:
@Transient
public class OAuth2IntrospectionAuthenticationToken
It'd also be good to add a test to confirm that by default no session is created when an app is configured for introspection.