I have an api server that relies on an auth server (both owned by the same company). Once the client gets a grant from the auth server, it is no longer needed, because the only information I need from the auth server is the user profile. Should I in this case cache the user profile on the api server, along with the access token? I want to do this so that I don't have to keep calling the auth server every non-auth related request.
- The api has no authentication on its own, it trusts the auth server and vice versa.
Is this a good pattern? Or instead should I issue an access token from the api server, after the authentication with the auth server was validated?