Is it safe to trust old tokens?

[Amri91]

If it is, we can save 1 db hit. And the main purpose of authomatic stores will be to tell us whether refresh tokens have been invalidated.

[Avaq]

This makes the assumption that given enough time, an attacker could forge a signature on a specific payload. I'm not sure exactly how distrusting old tokens solves this issue though, because it all depends on how we determine that an access token is "old".

[Amri91]

I was wrong. I believe the assumption that tokens should not be trusted when they are old is false. But before I remove the logic that does this, I wanted to be sure.

With that said, it is not causing any issues for now except for 1 extra db hit.