Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token and ID token). To my understanding, application server now has to contact the auth server to validate these tokens. If tokens are valid, the application server accepts the request. Otherwise, the request is rejected. Is this correct?
The main issue I have with this setup is the requirement to contact auth server for every request. Is there a standard way to avoid this? Is it possible to use a secret key (known to both the auth and application server) to validate a signature - similar to JWT. In this case what is the difference between OpenID Connect + OAuth2 and JWT?