{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/495","labels_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/495/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/495/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/495/events","html_url":"https://github.com/spring-projects/spring-security-oauth/issues/495","id":83650091,"number":495,"title":"JwtAccessTokenConverter class implementation scalability constrains","user":{"login":"isalgado","id":6472886,"avatar_url":"https://avatars.githubusercontent.com/u/6472886?v=3","gravatar_id":"","url":"https://api.github.com/users/isalgado","html_url":"https://github.com/isalgado","followers_url":"https://api.github.com/users/isalgado/followers","following_url":"https://api.github.com/users/isalgado/following{/other_user}","gists_url":"https://api.github.com/users/isalgado/gists{/gist_id}","starred_url":"https://api.github.com/users/isalgado/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/isalgado/subscriptions","organizations_url":"https://api.github.com/users/isalgado/orgs","repos_url":"https://api.github.com/users/isalgado/repos","events_url":"https://api.github.com/users/isalgado/events{/privacy}","received_events_url":"https://api.github.com/users/isalgado/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-01T19:12:39Z","updated_at":"2015-06-01T19:12:39Z","closed_at":null,"body":"In the current implementation a random verification key is created for each application instance.\r\n\r\nprivate String verifierKey = new RandomValueStringGenerator().generate();\r\n\r\nSo, from my understanding, this limits the scalability capacity that using JWT provides since an access token valid in one application instance is not valid in another. Another mechanism might be used, based on the certificate in order to have the same verifier in all the app instances."}}