**Approach (brief)** Use multi-tier caching: per-process local LRU, per-edge node shared cache (Redis/Cluster) with hot-key protection. Validate cached introspection result cryptographically when possible (e.g., token signatures + kid/JWKS) to reduce introspections. Protect with stampede controls and support immediate revocation via invalidation channel.**Design details**- Edge/local caches - Local in-process LRU (very small, <10k entries) for lowest latency. - Shared regional cache (Redis cluster with replication + TTL) for cross-process hit rate.- TTL selection - Default TTL = min(token expiry - now, bounded by policy) e.g., 5m for access tokens, up to token.exp. - Shorter TTL for high-risk scopes (e.g., 30s).- Cache stampede protection - Use probabilistic early refresh (jittered TTL), and singleflight/mutex per key in the shared cache so one request refreshes while others wait or return stale-for-serve (serve-stale with grace).- Key rotation & revocation invalidation - Maintain JWKS cache; on kid mismatch trigger immediate JWKS reload. - For revocations: maintain revocation stream (pub/sub) that writes tombstones into Redis; local caches subscribe to invalidate entries. - Emergency revoke: write a short-lived "blacklist" key with high priority.**Pseudocode: token check flow**python
# Python-like pseudocode
def check_token(token):
key = token_hash(token)
# 1. local cache
entry = local_lru.get(key)
if entry and not entry.is_expired():
if entry.stale and not entry.validated_recently():
# background refresh
spawn_background(refresh_key, key)
return entry.allowed
# 2. shared cache (Redis) with singleflight
entry = redis.get(key)
if entry and not entry.is_expired():
local_lru.set(key, entry)
return entry.allowed
# 3. singleflight to prevent stampede
with singleflight.lock(key):
# double-check after acquiring lock
entry = redis.get(key)
if entry and not entry.is_expired():
local_lru.set(key, entry)
return entry.allowed
# 4. fallback to introspection endpoint
resp = introspect(token) # remote call, rate-limited & retried
if resp.error:
# optionally serve-stale if available
stale = redis.get_stale(key)
if stale: return stale.allowed
return deny()
# compute ttl = min(resp.exp - now, policy_ttl)
ttl = compute_ttl(resp)
redis.set(key, resp, ttl=ttl)
local_lru.set(key, resp)
return resp.allowed
