{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75/events","html_url":"https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75","id":134234950,"number":75,"title":"Security concerns regarding cache","user":{"login":"bureus","id":603643,"avatar_url":"https://avatars.githubusercontent.com/u/603643?v=3","gravatar_id":"","url":"https://api.github.com/users/bureus","html_url":"https://github.com/bureus","followers_url":"https://api.github.com/users/bureus/followers","following_url":"https://api.github.com/users/bureus/following{/other_user}","gists_url":"https://api.github.com/users/bureus/gists{/gist_id}","starred_url":"https://api.github.com/users/bureus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bureus/subscriptions","organizations_url":"https://api.github.com/users/bureus/orgs","repos_url":"https://api.github.com/users/bureus/repos","events_url":"https://api.github.com/users/bureus/events{/privacy}","received_events_url":"https://api.github.com/users/bureus/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-17T09:59:26Z","updated_at":"2016-02-17T12:03:00Z","closed_at":null,"body":"Isn't it a security concern that the key in the cache is the plain token?... Should it not be encrypted before its stored as the cache key? Otherwise I can just read the keys of the cache and act as someone else? \r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/comments/185172366","html_url":"https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75#issuecomment-185172366","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.AccessTokenValidation/issues/75","id":185172366,"user":{"login":"bureus","id":603643,"avatar_url":"https://avatars.githubusercontent.com/u/603643?v=3","gravatar_id":"","url":"https://api.github.com/users/bureus","html_url":"https://github.com/bureus","followers_url":"https://api.github.com/users/bureus/followers","following_url":"https://api.github.com/users/bureus/following{/other_user}","gists_url":"https://api.github.com/users/bureus/gists{/gist_id}","starred_url":"https://api.github.com/users/bureus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bureus/subscriptions","organizations_url":"https://api.github.com/users/bureus/orgs","repos_url":"https://api.github.com/users/bureus/repos","events_url":"https://api.github.com/users/bureus/events{/privacy}","received_events_url":"https://api.github.com/users/bureus/received_events","type":"User","site_admin":false},"created_at":"2016-02-17T12:03:00Z","updated_at":"2016-02-17T12:03:00Z","body":"but as you say, you could add the \"encryption\" of the key inside the cache implementation. But then it could be missed easily... "}}