I believe that it's specified in the architectural reference framework that it has to re-validate every session, to ensure that the token hasn't been revoked. I'd be happy to be corrected, though!
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
replies: