My resource server exposes an API that expects JWT access tokens obtained using OpenID Connect.
So far the validation in the resource server side consisted on using the Realm public key to validate the JWT access token signature and check some other parameters suchs as expiration time.
Since the access token is a JWT, I already have information about the user (sub, role claims etc). So I wouldn't need to invoke the introspection endpoint to get it.
However the introspection endpoint also anwers with the active state of a token. Does it make sense to use it as another step in the JWT access token validation process? Is it really necessary or should I consider it valid just checking the signature and the other claims?
Is the tradeoff of the added latency to invoke just another endpoint to validate worth it?