Related to#14982

Problem

At present, every time a request for an external auth token is made,ValidateToken is called. If the jwt is not expired, but revoked on the IdP side, then Coder will consistently retry to use the token.

This can cause excessive IdP requests, and hit rate limits.

Failed refreshes were fixed such that they are not retried here:#15608

Solution

Do not reuse invalid tokens, caching the invalid error and preventing them from causing duplicate failed requests.

Notes

• Is it enough to see a 401 or 403 on thevalidate_url? If hit, deleting the external auth link would prevent reuse, or caching the error in the database.
• This might be helpful?https://www.oauth.com/oauth2-servers/token-introspection-endpoint/