Claude 5c555ca7b5 Cache validated access tokens to skip per-request HMAC verify ...

async_validate_access_token ran a full HMAC-SHA256 signature verify plus
claims validation on every authenticated request, even though the
signature of a given token string never changes. Only the exp claim is
time-dependent.

Cache the (refresh_token_id, exp) of each successfully validated token in
a bounded LRU. On a repeat request the hot path becomes a dict lookup, an
exp comparison and the existing refresh-token lookup, skipping the HMAC
verify entirely.

Security is unchanged:
- Only tokens that pass the full signature/issuer/iat verification are
  ever cached, so a forged token can never enter the cache.
- The refresh token is re-fetched from the store on every call, so a
  revoked or removed token (its refresh token is gone) is still rejected,
  and an inactive user is still rejected.
- The exp claim is rechecked against the same leeway on every cache hit,
  so an expired token is still rejected (and evicted).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PXQwLpKCf8FvhWoSc2Jw61

2026-07-03 21:00:05 +00:00

..

mfa_modules

Use is/is not for same-enum identity comparisons (tests) (#171689)

2026-05-22 11:32:27 +02:00

permissions

Filter history API responses by per-entity read permissions (#169236)

2026-04-29 12:16:49 +02:00

providers

Use is/is not for same-enum identity comparisons (tests) (#171689)

2026-05-22 11:32:27 +02:00

__init__.py

…

test_auth_store.py

…

test_init.py

Cache validated access tokens to skip per-request HMAC verify

2026-07-03 21:00:05 +00:00

test_jwt_wrapper.py

Update PyJWT to 2.12.1 (#168239)

2026-04-16 10:44:41 +02:00

test_models.py

…