<p>To keep track of all the tokens produced by its server services, OpenIddict 3.0 creates a token entry in the database for each generated token.
A token entry contains metadata like the subject of the token, the client identifier of the application it was issued to or its creation and expiration dates.</p>
<p>By default, the token payload – generated using either the
<ahref="https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/">Azure Active Directory IdentityModel Extensions for .NET library</a> for JWT tokens or
<ahref="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/introduction">ASP.NET Core Data Protection</a> for Data Protection tokens – is never stored in the database,
except for authorization codes (that are short-lived), device and user codes (exclusively used in the device code flow).</p>
<p>Such tokens – called reference tokens – are not returned as-is to the caller: instead, their payload is stored in the database entry and a crypto-secure random 256-bit identifier
– called reference identifier – is returned as a base64url-encoded string and serves as the "final" token used by the client application when communicating with OpenIddict's endpoints
<divclass="NOTE"><h5>Note</h5><p>In OpenIddict 3.0, the ability to revoke a token is not tied to the token format and doesn't require enabling reference tokens:
<li>Use the ASP.NET Core Data Protection format for access and refresh tokens, as they benefit from additional security measures that would prevent them from being sent as-is if
they were stolen from the database. For more information on how to enable ASP.NET Core Data Protection, read <ahref="token-formats.html">Token formats</a>.</li>
<li>Enable column encryption/data at rest encryption to protect the <code>Payload</code> column of token entries.</li>
</code></pre><h2id="enabling-token-entry-validation-at-the-api-level">Enabling token entry validation at the API level</h2>
<p><strong>For performance reasons, OpenIddict 3.0 doesn't check, by default, the status of a token entry when receiving an API request</strong>: access tokens are considered valid until they expire.
For scenarios that require immediate access token revocation, the OpenIddict validation handler can be configured to enforce token entry validation for each API request:</p>
<divclass="NOTE"><h5>Note</h5><p>Enabling token entry validation requires that the OpenIddict validation handler have a direct access to the server database where tokens are stored, which makes it
better suited for APIs located in the same application as the authorization server. For external applications, consider using introspection instead of local validation.</p>
<p>In both cases, additional latency – caused by the additional DB request and the HTTP call for introspection – is expected.</p>
</code></pre><divclass="WARNING"><h5>Warning</h5><p>Disabling token storage prevents reference access or refresh tokens support from being enabled, as this requires storing the tokens in the database.</p>
