Why not use InMemory operational store?

Question

There are some recommendations to replace InMemory operational store when going in production but what are actual roots of this suggestion?

I see these disadvantages of going with the default IPersistedGrantStore:

1. No persistance: when the server is restarted all users have to re-login
2. Sticky sessions are required, users can refresh tokens only at their instance

Are there other issues I may encounter?

Answer 1

I think you could find more problems with distributed services such as:

3. Reference tokens: reference tokens should be validated against the same instance that issued them when calling introspection from backend services.
4. Backend Token revokation: You'll need to call all instances to ensure revokation from backend.
5. Consent: you couldn't save consent preferences for users (rememeber consent).
6. Refresh tokens: you can't use long-lived refresh tokens among sessions and your user must be always present. You cannot use offline access.