Enable session validation support in the server and validation stacks

sandbox/OpenIddict.Sandbox.AspNetCore.Server/Program.cs

@@ -320,10 +320,11 @@ builder.Services.AddOpenIddict()
         // For applications that need immediate access token or authorization
         // revocation, the database entry of the received tokens and their
         // associated authorizations can be validated for each API call.
-        // Enabling these options may have a negative impact on performance.
         //
-        // options.EnableAuthorizationEntryValidation();
+        // Note: enabling these options may have a negative impact on performance.
-        // options.EnableTokenEntryValidation();
+        options.EnableAuthorizationEntryValidation()
+               .EnableSessionEntryValidation()
+               .EnableTokenEntryValidation();
     });
 
 builder.Services.AddTransient<IEmailSender, AuthMessageSender>();

src/OpenIddict.Abstractions/Descriptors/OpenIddictTokenDescriptor.cs

@@ -60,6 +60,11 @@ public class OpenIddictTokenDescriptor
     /// </remarks>
     public string? ReferenceId { get; set; }
 
+    /// <summary>
+    /// Gets or sets the identifier of the session associated with the token.
+    /// </summary>
+    public string? SessionId { get; set; }
+
     /// <summary>
     /// Gets or sets the status of the token.
     /// </summary>

src/OpenIddict.Abstractions/Managers/IOpenIddictSessionManager.cs

@@ -258,6 +258,15 @@ public interface IOpenIddictSessionManager
     /// </returns>
     ValueTask<string?> GetSubjectAsync(object session, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Determines whether a given session has the specified status.
+    /// </summary>
+    /// <param name="session">The session.</param>
+    /// <param name="status">The expected status.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns><see langword="true"/> if the session has the specified status, <see langword="false"/> otherwise.</returns>
+    ValueTask<bool> HasStatusAsync(object session, string status, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Executes the specified query and returns all the corresponding elements.
     /// </summary>

src/OpenIddict.Abstractions/Managers/IOpenIddictTokenManager.cs

@@ -277,6 +277,17 @@ public interface IOpenIddictTokenManager
     /// </returns>
     ValueTask<string?> GetReferenceIdAsync(object token, CancellationToken cancellationToken = default);
 
+    /// <summary>
+    /// Retrieves the optional session identifier associated with a token.
+    /// </summary>
+    /// <param name="token">The token.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns>
+    /// A <see cref="ValueTask{TResult}"/> that can be used to monitor the asynchronous operation,
+    /// whose result returns the session identifier associated with the token.
+    /// </returns>
+    ValueTask<string?> GetSessionIdAsync(object token, CancellationToken cancellationToken = default);
+
     /// <summary>
     /// Retrieves the status associated with a token.
     /// </summary>

src/OpenIddict.Abstractions/OpenIddictResources.resx

@@ -537,10 +537,7 @@ Reference the 'OpenIddict.Validation.SystemNetHttp' package and call 'services.A
     <value>The client secret cannot be null or empty when using introspection. Alternatively, one or multiple signing credentials can be registered and used as TLS client certificates or to produce client assertions if the authorization server supports it.</value>
   </data>
   <data name="ID0133" xml:space="preserve">
-    <value>Authorization entry validation cannot be enabled when using introspection.</value>
+    <value>Authorization entry, session entry and token entry validation cannot be enabled when using introspection.</value>
-  </data>
-  <data name="ID0134" xml:space="preserve">
-    <value>Token entry validation cannot be enabled when using introspection.</value>
   </data>
   <data name="ID0135" xml:space="preserve">
     <value>A discovery client must be registered when using server discovery.
@@ -557,7 +554,7 @@ Reference the 'OpenIddict.Validation.SystemNetHttp' package and call 'services.A
 This may indicate that it was not properly registered in the dependency injection container. To register an event handler, use 'services.AddOpenIddict().AddValidation().AddEventHandler()'.</value>
   </data>
   <data name="ID0139" xml:space="preserve">
-    <value>The core services must be registered when enabling token entry validation.
+    <value>The core services must be registered when enabling authorization entry, session entry or token entry validation.
 To register the OpenIddict core services, reference the 'OpenIddict.Core' package and call 'services.AddOpenIddict().AddCore()' from 'ConfigureServices'.</value>
   </data>
   <data name="ID0140" xml:space="preserve">
@@ -566,10 +563,6 @@ To register the OpenIddict core services, reference the 'OpenIddict.Core' packag
   <data name="ID0141" xml:space="preserve">
     <value>An unknown error occurred while introspecting the access token.</value>
   </data>
-  <data name="ID0142" xml:space="preserve">
-    <value>The core services must be registered when enabling authorization entry validation.
-To register the OpenIddict core services, reference the 'OpenIddict.Core' package and call 'services.AddOpenIddict().AddCore()' from 'ConfigureServices'.</value>
-  </data>
   <data name="ID0143" xml:space="preserve">
     <value>The URI cannot be null or empty.</value>
   </data>
@@ -856,10 +849,7 @@ Reload the entity from the database and retry the operation.</value>
 Make sure that the entity is not abstract and has a public parameterless constructor or create a custom store that overrides 'InstantiateAsync()' to use a custom factory.</value>
   </data>
   <data name="ID0244" xml:space="preserve">
-    <value>The application matching the specified identifier cannot be found in the change tracker or in the database.</value>
+    <value>The entity matching the specified identifier cannot be found in the change tracker or in the database.</value>
-  </data>
-  <data name="ID0251" xml:space="preserve">
-    <value>The authorization matching the specified identifier cannot be found in the change tracker or in the database.</value>
   </data>
   <data name="ID0253" xml:space="preserve">
     <value>No Entity Framework Core context was configured to be used with OpenIddict.
@@ -2430,6 +2420,9 @@ To use a custom policy relying on the system store, set 'OpenIddictServerOptions
   <data name="ID2209" xml:space="preserve">
     <value>The login identifier cannot be null or empty and must match the value used to represent the user session.</value>
   </data>
+  <data name="ID2210" xml:space="preserve">
+    <value>The session associated with the token is no longer valid.</value>
+  </data>
   <data name="ID4000" xml:space="preserve">
     <value>The '{0}' parameter shouldn't be null or empty at this point.</value>
   </data>
@@ -2496,6 +2489,9 @@ To use a custom policy relying on the system store, set 'OpenIddictServerOptions
   <data name="ID4021" xml:space="preserve">
     <value>The length of the memory span ({0}) doesn't match the expected value ({1}).</value>
   </data>
+  <data name="ID4022" xml:space="preserve">
+    <value>The session identifier shouldn't be null or empty at this point.</value>
+  </data>
   <data name="ID6000" xml:space="preserve">
     <value>An error occurred while validating the token '{Token}'.</value>
   </data>
@@ -3288,6 +3284,9 @@ This may indicate that the hashed entry is corrupted or malformed.</value>
   <data name="ID6296" xml:space="preserve">
     <value>A signing key of type '{Type}' was ignored because its ML-DSA public key couldn't be extracted.</value>
   </data>
+  <data name="ID6297" xml:space="preserve">
+    <value>The session '{Identifier}' was no longer valid.</value>
+  </data>
   <data name="ID8000" xml:space="preserve">
     <value>https://documentation.openiddict.com/errors/{0}</value>
   </data>

src/OpenIddict.Abstractions/Stores/IOpenIddictTokenStore.cs

@@ -232,6 +232,17 @@ public interface IOpenIddictTokenStore<TToken> where TToken : class
     /// </returns>
     ValueTask<string?> GetReferenceIdAsync(TToken token, CancellationToken cancellationToken);
 
+    /// <summary>
+    /// Retrieves the optional session identifier associated with a token.
+    /// </summary>
+    /// <param name="token">The token.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns>
+    /// A <see cref="ValueTask{TResult}"/> that can be used to monitor the asynchronous operation,
+    /// whose result returns the session identifier associated with the token.
+    /// </returns>
+    ValueTask<string?> GetSessionIdAsync(TToken token, CancellationToken cancellationToken);
+
     /// <summary>
     /// Retrieves the status associated with a token.
     /// </summary>
@@ -359,6 +370,15 @@ public interface IOpenIddictTokenStore<TToken> where TToken : class
     /// <returns>A <see cref="ValueTask"/> that can be used to monitor the asynchronous operation.</returns>
     ValueTask SetAuthorizationIdAsync(TToken token, string? identifier, CancellationToken cancellationToken);
 
+    /// <summary>
+    /// Sets the session identifier associated with a token.
+    /// </summary>
+    /// <param name="token">The token.</param>
+    /// <param name="identifier">The unique identifier associated with the token.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns>A <see cref="ValueTask"/> that can be used to monitor the asynchronous operation.</returns>
+    ValueTask SetSessionIdAsync(TToken token, string? identifier, CancellationToken cancellationToken);
+
     /// <summary>
     /// Sets the creation date associated with a token.
     /// </summary>

src/OpenIddict.Core/Managers/OpenIddictAuthorizationManager.cs

@@ -133,6 +133,12 @@ public class OpenIddictAuthorizationManager<TAuthorization> : IOpenIddictAuthori
             await Store.SetStatusAsync(authorization, Statuses.Valid, cancellationToken);
         }
 
+        // If no creation date was explicitly specified, set it to the current time.
+        if (await Store.GetCreationDateAsync(authorization, cancellationToken) is null)
+        {
+            await Store.SetCreationDateAsync(authorization, Options.CurrentValue.TimeProvider.GetUtcNow(), cancellationToken);
+        }
+
         var results = await GetValidationResultsAsync(authorization, cancellationToken);
         if (results.Any(static result => result != ValidationResult.Success))
         {

src/OpenIddict.Core/Managers/OpenIddictSessionManager.cs

@@ -132,6 +132,12 @@ public class OpenIddictSessionManager<TSession> : IOpenIddictSessionManager wher
             await Store.SetStatusAsync(session, Statuses.Valid, cancellationToken);
         }
 
+        // If no creation date was explicitly specified, set it to the current time.
+        if (await Store.GetCreationDateAsync(session, cancellationToken) is null)
+        {
+            await Store.SetCreationDateAsync(session, Options.CurrentValue.TimeProvider.GetUtcNow(), cancellationToken);
+        }
+
         var results = await GetValidationResultsAsync(session, cancellationToken);
         if (results.Any(static result => result != ValidationResult.Success))
         {
@@ -601,6 +607,21 @@ public class OpenIddictSessionManager<TSession> : IOpenIddictSessionManager wher
         return Store.GetSubjectAsync(session, cancellationToken);
     }
 
+    /// <summary>
+    /// Determines whether a given session has the specified status.
+    /// </summary>
+    /// <param name="session">The session.</param>
+    /// <param name="status">The expected status.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns><see langword="true"/> if the session has the specified status, <see langword="false"/> otherwise.</returns>
+    public virtual async ValueTask<bool> HasStatusAsync(TSession session, string status, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(session);
+        ArgumentException.ThrowIfNullOrEmpty(status);
+
+        return string.Equals(await GetStatusAsync(session, cancellationToken), status, StringComparison.Ordinal);
+    }
+
     /// <summary>
     /// Executes the specified query and returns all the corresponding elements.
     /// </summary>
@@ -898,6 +919,10 @@ public class OpenIddictSessionManager<TSession> : IOpenIddictSessionManager wher
     ValueTask<string?> IOpenIddictSessionManager.GetSubjectAsync(object session, CancellationToken cancellationToken)
         => GetSubjectAsync((TSession) session, cancellationToken);
 
+    /// <inheritdoc/>
+    ValueTask<bool> IOpenIddictSessionManager.HasStatusAsync(object session, string status, CancellationToken cancellationToken)
+        => HasStatusAsync((TSession) session, status, cancellationToken);
+
     /// <inheritdoc/>
     IAsyncEnumerable<object> IOpenIddictSessionManager.ListAsync(int? count, int? offset, CancellationToken cancellationToken)
         => ListAsync(count, offset, cancellationToken);

src/OpenIddict.Core/Managers/OpenIddictTokenManager.cs

@@ -134,6 +134,12 @@ public class OpenIddictTokenManager<TToken> : IOpenIddictTokenManager where TTok
             await Store.SetStatusAsync(token, Statuses.Valid, cancellationToken);
         }
 
+        // If no creation date was explicitly specified, set it to the current time.
+        if (await Store.GetCreationDateAsync(token, cancellationToken) is null)
+        {
+            await Store.SetCreationDateAsync(token, Options.CurrentValue.TimeProvider.GetUtcNow(), cancellationToken);
+        }
+
         // If a reference identifier was set, obfuscate it.
         var identifier = await Store.GetReferenceIdAsync(token, cancellationToken);
         if (!string.IsNullOrEmpty(identifier))
@@ -632,6 +638,22 @@ public class OpenIddictTokenManager<TToken> : IOpenIddictTokenManager where TTok
         return Store.GetReferenceIdAsync(token, cancellationToken);
     }
 
+    /// <summary>
+    /// Retrieves the optional session identifier associated with a token.
+    /// </summary>
+    /// <param name="token">The token.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
+    /// <returns>
+    /// A <see cref="ValueTask{TResult}"/> that can be used to monitor the asynchronous operation,
+    /// whose result returns the session identifier associated with the token.
+    /// </returns>
+    public virtual ValueTask<string?> GetSessionIdAsync(TToken token, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        return Store.GetSessionIdAsync(token, cancellationToken);
+    }
+
     /// <summary>
     /// Retrieves the status associated with a token.
     /// </summary>
@@ -820,6 +842,7 @@ public class OpenIddictTokenManager<TToken> : IOpenIddictTokenManager where TTok
         await Store.SetPropertiesAsync(token, descriptor.Properties.ToImmutableDictionary(), cancellationToken);
         await Store.SetRedemptionDateAsync(token, descriptor.RedemptionDate, cancellationToken);
         await Store.SetReferenceIdAsync(token, descriptor.ReferenceId, cancellationToken);
+        await Store.SetSessionIdAsync(token, descriptor.SessionId, cancellationToken);
         await Store.SetStatusAsync(token, descriptor.Status, cancellationToken);
         await Store.SetSubjectAsync(token, descriptor.Subject, cancellationToken);
         await Store.SetTypeAsync(token, descriptor.Type, cancellationToken);
@@ -848,6 +871,7 @@ public class OpenIddictTokenManager<TToken> : IOpenIddictTokenManager where TTok
         descriptor.Payload = await Store.GetPayloadAsync(token, cancellationToken);
         descriptor.RedemptionDate = await Store.GetRedemptionDateAsync(token, cancellationToken);
         descriptor.ReferenceId = await Store.GetReferenceIdAsync(token, cancellationToken);
+        descriptor.SessionId = await Store.GetSessionIdAsync(token, cancellationToken);
         descriptor.Status = await Store.GetStatusAsync(token, cancellationToken);
         descriptor.Subject = await Store.GetSubjectAsync(token, cancellationToken);
         descriptor.Type = await Store.GetTypeAsync(token, cancellationToken);
@@ -1272,6 +1296,10 @@ public class OpenIddictTokenManager<TToken> : IOpenIddictTokenManager where TTok
     ValueTask<string?> IOpenIddictTokenManager.GetReferenceIdAsync(object token, CancellationToken cancellationToken)
         => GetReferenceIdAsync((TToken) token, cancellationToken);
 
+    /// <inheritdoc/>
+    ValueTask<string?> IOpenIddictTokenManager.GetSessionIdAsync(object token, CancellationToken cancellationToken)
+        => GetSessionIdAsync((TToken) token, cancellationToken);
+
     /// <inheritdoc/>
     ValueTask<string?> IOpenIddictTokenManager.GetStatusAsync(object token, CancellationToken cancellationToken)
         => GetStatusAsync((TToken) token, cancellationToken);

src/OpenIddict.EntityFramework/Stores/OpenIddictEntityFrameworkSessionStore.cs

@@ -644,7 +644,7 @@ public class OpenIddictEntityFrameworkSessionStore<
 
             session.Authorization = await context.Set<TAuthorization>().FindAsync(
                 cancellationToken, ConvertIdentifierFromString(identifier))
-                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0251));
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
         }
 
         else

src/OpenIddict.EntityFramework/Stores/OpenIddictEntityFrameworkTokenStore.cs

@@ -437,6 +437,33 @@ public class OpenIddictEntityFrameworkTokenStore<
         return new(token.ReferenceId);
     }
 
+    /// <inheritdoc/>
+    public virtual async ValueTask<string?> GetSessionIdAsync(TToken token, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        // If the session is not attached to the token, try to load it manually.
+        if (token.Session is null)
+        {
+            var context = await Context.GetDbContextAsync(cancellationToken);
+
+            var reference = context.Entry(token).Reference(static entry => entry.Session);
+            if (reference.EntityEntry.State is EntityState.Detached)
+            {
+                return null;
+            }
+
+            await reference.LoadAsync(cancellationToken);
+        }
+
+        if (token.Session is null)
+        {
+            return null;
+        }
+
+        return ConvertIdentifierToString(token.Session.Id);
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask<string?> GetStatusAsync(TToken token, CancellationToken cancellationToken)
     {
@@ -855,7 +882,7 @@ public class OpenIddictEntityFrameworkTokenStore<
 
             token.Authorization = await context.Set<TAuthorization>().FindAsync(
                 cancellationToken, ConvertIdentifierFromString(identifier))
-                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0251));
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
         }
 
         else
@@ -964,6 +991,40 @@ public class OpenIddictEntityFrameworkTokenStore<
         return ValueTask.CompletedTask;
     }
 
+    /// <inheritdoc/>
+    public virtual async ValueTask SetSessionIdAsync(TToken token, string? identifier, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        if (!string.IsNullOrEmpty(identifier))
+        {
+            var context = await Context.GetDbContextAsync(cancellationToken);
+
+            token.Session = await context.Set<TSession>().FindAsync(
+                cancellationToken, ConvertIdentifierFromString(identifier))
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
+        }
+
+        else
+        {
+            // If the session is not attached to the token, try to load it manually.
+            if (token.Session is null)
+            {
+                var context = await Context.GetDbContextAsync(cancellationToken);
+
+                var reference = context.Entry(token).Reference(static entry => entry.Session);
+                if (reference.EntityEntry.State is EntityState.Detached)
+                {
+                    return;
+                }
+
+                await reference.LoadAsync(cancellationToken);
+            }
+
+            token.Session = null;
+        }
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask SetStatusAsync(TToken token, string? status, CancellationToken cancellationToken)
     {

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreSessionStore.cs

@@ -654,7 +654,7 @@ public class OpenIddictEntityFrameworkCoreSessionStore<
 
             session.Authorization = await context.Set<TAuthorization>()
                 .FindAsync([ConvertIdentifierFromString(identifier)], cancellationToken)
-                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0251));
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
         }
 
         else

src/OpenIddict.EntityFrameworkCore/Stores/OpenIddictEntityFrameworkCoreTokenStore.cs

@@ -418,6 +418,33 @@ public class OpenIddictEntityFrameworkCoreTokenStore<
         return new(token.ReferenceId);
     }
 
+    /// <inheritdoc/>
+    public virtual async ValueTask<string?> GetSessionIdAsync(TToken token, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        // If the session is not attached to the token, try to load it manually.
+        if (token.Session is null)
+        {
+            var context = await Context.GetDbContextAsync(cancellationToken);
+
+            var reference = context.Entry(token).Reference(static entry => entry.Session);
+            if (reference.EntityEntry.State is EntityState.Detached)
+            {
+                return null;
+            }
+
+            await reference.LoadAsync(cancellationToken);
+        }
+
+        if (token.Session is null)
+        {
+            return null;
+        }
+
+        return ConvertIdentifierToString(token.Session.Id);
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask<string?> GetStatusAsync(TToken token, CancellationToken cancellationToken)
     {
@@ -927,7 +954,7 @@ public class OpenIddictEntityFrameworkCoreTokenStore<
 
             token.Authorization = await context.Set<TAuthorization>()
                 .FindAsync([ConvertIdentifierFromString(identifier)], cancellationToken)
-                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0251));
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
         }
 
         else
@@ -950,6 +977,40 @@ public class OpenIddictEntityFrameworkCoreTokenStore<
         }
     }
 
+    /// <inheritdoc/>
+    public virtual async ValueTask SetSessionIdAsync(TToken token, string? identifier, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        if (!string.IsNullOrEmpty(identifier))
+        {
+            var context = await Context.GetDbContextAsync(cancellationToken);
+
+            token.Session = await context.Set<TSession>()
+                .FindAsync([ConvertIdentifierFromString(identifier)], cancellationToken)
+                ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0244));
+        }
+
+        else
+        {
+            // If the session is not attached to the token, try to load it manually.
+            if (token.Session is null)
+            {
+                var context = await Context.GetDbContextAsync(cancellationToken);
+
+                var reference = context.Entry(token).Reference(static entry => entry.Session);
+                if (reference.EntityEntry.State is EntityState.Detached)
+                {
+                    return;
+                }
+
+                await reference.LoadAsync(cancellationToken);
+            }
+
+            token.Session = null;
+        }
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask SetCreationDateAsync(TToken token, DateTimeOffset? date, CancellationToken cancellationToken)
     {

src/OpenIddict.MongoDb/Stores/OpenIddictMongoDbTokenStore.cs

@@ -319,6 +319,14 @@ public class OpenIddictMongoDbTokenStore<
         return new(token.ReferenceId);
     }
 
+    /// <inheritdoc/>
+    public virtual ValueTask<string?> GetSessionIdAsync(TToken token, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        return new(token.SessionId != ObjectId.Empty ? token.SessionId.ToString() : null);
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask<string?> GetStatusAsync(TToken token, CancellationToken cancellationToken)
     {
@@ -622,6 +630,16 @@ public class OpenIddictMongoDbTokenStore<
         return ValueTask.CompletedTask;
     }
 
+    /// <inheritdoc/>
+    public virtual ValueTask SetSessionIdAsync(TToken token, string? identifier, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(token);
+
+        token.SessionId = !string.IsNullOrEmpty(identifier) ? ObjectId.Parse(identifier) : ObjectId.Empty;
+
+        return ValueTask.CompletedTask;
+    }
+
     /// <inheritdoc/>
     public virtual ValueTask SetStatusAsync(TToken token, string? status, CancellationToken cancellationToken)
     {

src/OpenIddict.Server/OpenIddictServerEvents.Protection.cs

@@ -189,6 +189,11 @@ public static partial class OpenIddictServerEvents
         /// </summary>
         public string? AuthorizationId { get; set; }
 
+        /// <summary>
+        /// Gets or sets the session entry identifier associated with the token, if applicable.
+        /// </summary>
+        public string? SessionId { get; set; }
+
         /// <summary>
         /// Gets or sets the token entry identifier associated with the token, if applicable.
         /// </summary>

src/OpenIddict.Server/OpenIddictServerExtensions.cs

@@ -82,6 +82,7 @@ public static class OpenIddictServerExtensions
         builder.Services.TryAddSingleton<RequireRevocationRequest>();
         builder.Services.TryAddSingleton<RequireScopePermissionsEnabled>();
         builder.Services.TryAddSingleton<RequireScopeValidationEnabled>();
+        builder.Services.TryAddSingleton<RequireSessionIdResolved>();
         builder.Services.TryAddSingleton<RequireSlidingRefreshTokenExpirationEnabled>();
         builder.Services.TryAddSingleton<RequireSubjectTokenValidated>();
         builder.Services.TryAddSingleton<RequireTokenAudienceValidationEnabled>();

src/OpenIddict.Server/OpenIddictServerHandlerFilters.cs

@@ -655,6 +655,20 @@ public static class OpenIddictServerHandlerFilters
         }
     }
 
+    /// <summary>
+    /// Represents a filter that excludes the associated handlers if no session identifier is resolved from the token.
+    /// </summary>
+    public sealed class RequireSessionIdResolved : IOpenIddictServerHandlerFilter<ValidateTokenContext>
+    {
+        /// <inheritdoc/>
+        public ValueTask<bool> IsActiveAsync(ValidateTokenContext context)
+        {
+            ArgumentNullException.ThrowIfNull(context);
+
+            return new(!string.IsNullOrEmpty(context.SessionId));
+        }
+    }
+
     /// <summary>
     /// Represents a filter that excludes the associated handlers if sliding refresh token expiration was disabled.
     /// </summary>

src/OpenIddict.Server/OpenIddictServerHandlers.Protection.cs

@@ -44,6 +44,7 @@ public static partial class OpenIddictServerHandlers
             ValidateProofOfPossession.Descriptor,
             ValidateTokenEntry.Descriptor,
             ValidateAuthorizationEntry.Descriptor,
+            ValidateSessionEntry.Descriptor,
 
             /*
              * Token generation:
@@ -832,6 +833,7 @@ public static partial class OpenIddictServerHandlers
                     .SetCreationDate(await manager.GetCreationDateAsync(token, context.CancellationToken))
                     .SetExpirationDate(await manager.GetExpirationDateAsync(token, context.CancellationToken))
                     .SetAuthorizationId(context.AuthorizationId = await manager.GetAuthorizationIdAsync(token, context.CancellationToken))
+                    .SetSessionId(context.SessionId = await manager.GetSessionIdAsync(token, context.CancellationToken))
                     .SetTokenId(context.TokenId = await manager.GetIdAsync(token, context.CancellationToken))
                     .SetTokenType(await manager.GetTypeAsync(token, context.CancellationToken));
             }
@@ -1413,6 +1415,50 @@ public static partial class OpenIddictServerHandlers
             }
         }
 
+        /// <summary>
+        /// Contains the logic responsible for rejecting tokens whose
+        /// associated session entry is no longer valid (e.g was revoked).
+        /// Note: this handler is not used when the degraded mode is enabled.
+        /// </summary>
+        public sealed class ValidateSessionEntry : IOpenIddictServerHandler<ValidateTokenContext>
+        {
+            /// <summary>
+            /// Gets the default descriptor definition assigned to this handler.
+            /// </summary>
+            public static OpenIddictServerHandlerDescriptor Descriptor { get; }
+                = OpenIddictServerHandlerDescriptor.CreateBuilder<ValidateTokenContext>()
+                    .AddFilter<RequireDegradedModeDisabled>()
+                    .AddFilter<RequireSessionIdResolved>()
+                    .UseSingletonHandler<ValidateSessionEntry>()
+                    .SetOrder(ValidateAuthorizationEntry.Descriptor.Order + 1_000)
+                    .SetType(OpenIddictServerHandlerType.BuiltIn)
+                    .Build();
+
+            public async ValueTask HandleAsync(ValidateTokenContext context)
+            {
+                ArgumentNullException.ThrowIfNull(context);
+
+                Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
+                Debug.Assert(!string.IsNullOrEmpty(context.SessionId), SR.GetResourceString(SR.ID4022));
+
+                var manager = context.ServiceProvider.GetService<IOpenIddictSessionManager>()
+                    ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0016));
+
+                var session = await manager.FindByIdAsync(context.SessionId, context.CancellationToken);
+                if (session is null || !await manager.HasStatusAsync(session, Statuses.Valid, context.CancellationToken))
+                {
+                    context.Logger.LogInformation(6297, SR.GetResourceString(SR.ID6297), context.SessionId);
+
+                    context.Reject(
+                        error: Errors.InvalidToken,
+                        description: SR.GetResourceString(SR.ID2210),
+                        uri: SR.FormatID8000(SR.ID2210));
+
+                    return;
+                }
+            }
+        }
+
         /// <summary>
         /// Contains the logic responsible for resolving the signing and encryption credentials used to protect tokens.
         /// </summary>
@@ -1488,6 +1534,7 @@ public static partial class OpenIddictServerHandlers
                     CreationDate = context.Principal.GetCreationDate(),
                     ExpirationDate = context.Principal.GetExpirationDate(),
                     Principal = context.Principal,
+                    SessionId = context.Principal.GetSessionId(),
                     Type = context.TokenType
                 };
 

src/OpenIddict.Validation/OpenIddictValidationBuilder.cs

@@ -592,6 +592,16 @@ public sealed class OpenIddictValidationBuilder
     public OpenIddictValidationBuilder EnableAuthorizationEntryValidation()
         => Configure(options => options.EnableAuthorizationEntryValidation = true);
 
+    /// <summary>
+    /// Enables session validation so that a database call is made for each API request
+    /// to ensure the session associated with the access token is still valid.
+    /// Note: enabling this option may have an impact on performance and
+    /// can only be used with an OpenIddict-based authorization server.
+    /// </summary>
+    /// <returns>The <see cref="OpenIddictValidationBuilder"/> instance.</returns>
+    public OpenIddictValidationBuilder EnableSessionEntryValidation()
+        => Configure(options => options.EnableSessionEntryValidation = true);
+
     /// <summary>
     /// Enables token validation so that a database call is made for each API request
     /// to ensure the token entry associated with the access token is still valid.

src/OpenIddict.Validation/OpenIddictValidationConfiguration.cs

@@ -172,15 +172,11 @@ public sealed class OpenIddictValidationConfiguration : IPostConfigureOptions<Op
                 builder.AddError(SR.GetResourceString(SR.ID0132));
             }
 
-            if (options.EnableAuthorizationEntryValidation)
+            if (options.EnableAuthorizationEntryValidation ||
+                options.EnableSessionEntryValidation || options.EnableTokenEntryValidation)
             {
                 builder.AddError(SR.GetResourceString(SR.ID0133));
             }
-
-            if (options.EnableTokenEntryValidation)
-            {
-                builder.AddError(SR.GetResourceString(SR.ID0134));
-            }
         }
 
         var now = options.TimeProvider.GetUtcNow().LocalDateTime;

src/OpenIddict.Validation/OpenIddictValidationEvents.Protection.cs

@@ -178,6 +178,11 @@ public static partial class OpenIddictValidationEvents
         /// </summary>
         public string? AuthorizationId { get; set; }
 
+        /// <summary>
+        /// Gets or sets the session entry identifier associated with the token, if applicable.
+        /// </summary>
+        public string? SessionId { get; set; }
+
         /// <summary>
         /// Gets or sets the token entry identifier associated with the token, if applicable.
         /// </summary>

src/OpenIddict.Validation/OpenIddictValidationExtensions.cs

@@ -45,6 +45,8 @@ public static class OpenIddictValidationExtensions
         builder.Services.TryAddSingleton<RequireIntrospectionRequest>();
         builder.Services.TryAddSingleton<RequireJsonWebTokenFormat>();
         builder.Services.TryAddSingleton<RequireLocalValidation>();
+        builder.Services.TryAddSingleton<RequireSessionEntryValidationEnabled>();
+        builder.Services.TryAddSingleton<RequireSessionIdResolved>();
         builder.Services.TryAddSingleton<RequireTokenAudienceValidationEnabled>();
         builder.Services.TryAddSingleton<RequireTokenEntryValidationEnabled>();
         builder.Services.TryAddSingleton<RequireTokenIdResolved>();

src/OpenIddict.Validation/OpenIddictValidationHandlerFilters.cs

@@ -123,6 +123,34 @@ public static class OpenIddictValidationHandlerFilters
         }
     }
 
+    /// <summary>
+    /// Represents a filter that excludes the associated handlers if session validation was not enabled.
+    /// </summary>
+    public sealed class RequireSessionEntryValidationEnabled : IOpenIddictValidationHandlerFilter<BaseContext>
+    {
+        /// <inheritdoc/>
+        public ValueTask<bool> IsActiveAsync(BaseContext context)
+        {
+            ArgumentNullException.ThrowIfNull(context);
+
+            return new(context.Options.EnableSessionEntryValidation);
+        }
+    }
+
+    /// <summary>
+    /// Represents a filter that excludes the associated handlers if no session identifier is resolved from the token.
+    /// </summary>
+    public sealed class RequireSessionIdResolved : IOpenIddictValidationHandlerFilter<ValidateTokenContext>
+    {
+        /// <inheritdoc/>
+        public ValueTask<bool> IsActiveAsync(ValidateTokenContext context)
+        {
+            ArgumentNullException.ThrowIfNull(context);
+
+            return new(!string.IsNullOrEmpty(context.SessionId));
+        }
+    }
+
     /// <summary>
     /// Represents a filter that excludes the associated handlers if token audience validation was disabled.
     /// </summary>

src/OpenIddict.Validation/OpenIddictValidationHandlers.Protection.cs

@@ -42,6 +42,7 @@ public static partial class OpenIddictValidationHandlers
             ValidateProofOfPossession.Descriptor,
             ValidateTokenEntry.Descriptor,
             ValidateAuthorizationEntry.Descriptor,
+            ValidateSessionEntry.Descriptor,
 
             /*
              * Token generation:
@@ -586,6 +587,7 @@ public static partial class OpenIddictValidationHandlers
                     .SetCreationDate(await manager.GetCreationDateAsync(token, context.CancellationToken))
                     .SetExpirationDate(await manager.GetExpirationDateAsync(token, context.CancellationToken))
                     .SetAuthorizationId(context.AuthorizationId = await manager.GetAuthorizationIdAsync(token, context.CancellationToken))
+                    .SetSessionId(context.SessionId = await manager.GetSessionIdAsync(token, context.CancellationToken))
                     .SetTokenId(context.TokenId = await manager.GetIdAsync(token, context.CancellationToken))
                     .SetTokenType(await manager.GetTypeAsync(token, context.CancellationToken));
             }
@@ -955,7 +957,7 @@ public static partial class OpenIddictValidationHandlers
                 Debug.Assert(!string.IsNullOrEmpty(context.AuthorizationId), SR.GetResourceString(SR.ID4018));
 
                 var manager = context.ServiceProvider.GetService<IOpenIddictAuthorizationManager>()
-                    ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0142));
+                    ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0139));
 
                 var authorization = await manager.FindByIdAsync(context.AuthorizationId, context.CancellationToken);
                 if (authorization is null || !await manager.HasStatusAsync(authorization, Statuses.Valid, context.CancellationToken))
@@ -972,6 +974,50 @@ public static partial class OpenIddictValidationHandlers
             }
         }
 
+        /// <summary>
+        /// Contains the logic responsible for rejecting tokens whose
+        /// associated session entry is no longer valid (e.g was revoked).
+        /// </summary>
+        public sealed class ValidateSessionEntry : IOpenIddictValidationHandler<ValidateTokenContext>
+        {
+            /// <summary>
+            /// Gets the default descriptor definition assigned to this handler.
+            /// </summary>
+            public static OpenIddictValidationHandlerDescriptor Descriptor { get; }
+                = OpenIddictValidationHandlerDescriptor.CreateBuilder<ValidateTokenContext>()
+                    .AddFilter<RequireSessionEntryValidationEnabled>()
+                    .AddFilter<RequireSessionIdResolved>()
+                    .UseSingletonHandler<ValidateSessionEntry>()
+                    .SetOrder(ValidateAuthorizationEntry.Descriptor.Order + 1_000)
+                    .SetType(OpenIddictValidationHandlerType.BuiltIn)
+                    .Build();
+
+            /// <inheritdoc/>
+            public async ValueTask HandleAsync(ValidateTokenContext context)
+            {
+                ArgumentNullException.ThrowIfNull(context);
+
+                Debug.Assert(context.Principal is { Identity: ClaimsIdentity }, SR.GetResourceString(SR.ID4006));
+                Debug.Assert(!string.IsNullOrEmpty(context.SessionId), SR.GetResourceString(SR.ID4022));
+
+                var manager = context.ServiceProvider.GetService<IOpenIddictSessionManager>()
+                    ?? throw new InvalidOperationException(SR.GetResourceString(SR.ID0139));
+
+                var session = await manager.FindByIdAsync(context.SessionId, context.CancellationToken);
+                if (session is null || !await manager.HasStatusAsync(session, Statuses.Valid, context.CancellationToken))
+                {
+                    context.Logger.LogInformation(6297, SR.GetResourceString(SR.ID6297), context.SessionId);
+
+                    context.Reject(
+                        error: Errors.InvalidToken,
+                        description: SR.GetResourceString(SR.ID2210),
+                        uri: SR.FormatID8000(SR.ID2210));
+
+                    return;
+                }
+            }
+        }
+
         /// <summary>
         /// Contains the logic responsible for resolving the signing and encryption credentials used to protect tokens.
         /// </summary>

src/OpenIddict.Validation/OpenIddictValidationOptions.cs

@@ -101,6 +101,14 @@ public sealed class OpenIddictValidationOptions
     /// </summary>
     public bool EnableAuthorizationEntryValidation { get; set; }
 
+    /// <summary>
+    /// Gets or sets a boolean indicating whether a database call is made
+    /// to validate the session entry associated with the received tokens.
+    /// Note: enabling this option may have an impact on performance and
+    /// can only be used with an OpenIddict-based authorization server.
+    /// </summary>
+    public bool EnableSessionEntryValidation { get; set; }
+
     /// <summary>
     /// Gets or sets a boolean indicating whether a database call is made
     /// to validate the token entry associated with the received tokens.

test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.Protection.cs

@@ -630,4 +630,320 @@ public abstract partial class OpenIddictServerIntegrationTests
         // Assert
         Assert.Equal(SR.FormatID0005(TokenTypeIdentifiers.Private.AuthorizationCode, TokenTypeIdentifiers.AccessToken), exception.Message);
     }
+
+    [Fact]
+    public async Task ValidateToken_RequestIsRejectedWhenAuthorizationAssociatedWithTokenCannotBeFound()
+    {
+        // Arrange
+        var manager = CreateAuthorizationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByIdAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.AddEventHandler<ValidateTokenContext>(builder =>
+            {
+                builder.UseInlineHandler(context =>
+                {
+                    Assert.Equal("8xLOxBtZp8", context.Token);
+                    Assert.Equal([TokenTypeIdentifiers.RefreshToken], context.ValidTokenTypes);
+
+                    context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
+                        .SetTokenType(TokenTypeIdentifiers.RefreshToken)
+                        .SetTokenId("60FFF7EA-F98E-437B-937E-5073CC313103")
+                        .SetAuthorizationId("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0")
+                        .SetClaim(Claims.Subject, "Bob le Bricoleur");
+
+                    return ValueTask.CompletedTask;
+                });
+
+                builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
+            });
+
+            options.Services.AddSingleton(CreateTokenManager(mock =>
+            {
+                var token = new OpenIddictToken();
+
+                mock.Setup(manager => manager.FindByIdAsync("60FFF7EA-F98E-437B-937E-5073CC313103", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(token);
+
+                mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("60FFF7EA-F98E-437B-937E-5073CC313103");
+
+                mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(TokenTypeIdentifiers.RefreshToken);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Redeemed, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(false);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+
+                mock.Setup(manager => manager.GetAuthorizationIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0");
+            }));
+
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            GrantType = GrantTypes.TokenExchange,
+            SubjectToken = "8xLOxBtZp8",
+            SubjectTokenType = TokenTypeIdentifiers.RefreshToken
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidGrant, response.Error);
+        Assert.Equal(SR.GetResourceString(SR.ID2022), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2022), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByIdAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0", It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ValidateToken_RequestIsRejectedWhenAuthorizationAssociatedWithTokenIsInvalid()
+    {
+        // Arrange
+        var authorization = new OpenIddictAuthorization();
+
+        var manager = CreateAuthorizationManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByIdAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(authorization);
+
+            mock.Setup(manager => manager.HasStatusAsync(authorization, Statuses.Valid, It.IsAny<CancellationToken>()))
+                .ReturnsAsync(false);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.AddEventHandler<ValidateTokenContext>(builder =>
+            {
+                builder.UseInlineHandler(context =>
+                {
+                    Assert.Equal("8xLOxBtZp8", context.Token);
+                    Assert.Equal([TokenTypeIdentifiers.RefreshToken], context.ValidTokenTypes);
+
+                    context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
+                        .SetTokenType(TokenTypeIdentifiers.RefreshToken)
+                        .SetTokenId("60FFF7EA-F98E-437B-937E-5073CC313103")
+                        .SetAuthorizationId("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0")
+                        .SetClaim(Claims.Subject, "Bob le Bricoleur");
+
+                    return ValueTask.CompletedTask;
+                });
+
+                builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
+            });
+
+            options.Services.AddSingleton(CreateTokenManager(mock =>
+            {
+                var token = new OpenIddictToken();
+
+                mock.Setup(manager => manager.FindByIdAsync("60FFF7EA-F98E-437B-937E-5073CC313103", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(token);
+
+                mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("60FFF7EA-F98E-437B-937E-5073CC313103");
+
+                mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(TokenTypeIdentifiers.RefreshToken);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Redeemed, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(false);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+
+                mock.Setup(manager => manager.GetAuthorizationIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0");
+            }));
+
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            ActorToken = "accVkjcJyb4BWCxGsndESCJQbdFMogUC5PbRDqceLTC",
+            ActorTokenType = TokenTypeIdentifiers.AccessToken,
+            GrantType = GrantTypes.TokenExchange,
+            SubjectToken = "8xLOxBtZp8",
+            SubjectTokenType = TokenTypeIdentifiers.RefreshToken
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidGrant, response.Error);
+        Assert.Equal(SR.GetResourceString(SR.ID2022), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2022), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByIdAsync("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0", It.IsAny<CancellationToken>()), Times.Once());
+        Mock.Get(manager).Verify(manager => manager.HasStatusAsync(authorization, Statuses.Valid, It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ValidateToken_RequestIsRejectedWhenSessionAssociatedWithTokenCannotBeFound()
+    {
+        // Arrange
+        var manager = CreateSessionManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByIdAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(value: null);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.AddEventHandler<ValidateTokenContext>(builder =>
+            {
+                builder.UseInlineHandler(context =>
+                {
+                    Assert.Equal("8xLOxBtZp8", context.Token);
+                    Assert.Equal([TokenTypeIdentifiers.RefreshToken], context.ValidTokenTypes);
+
+                    context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
+                        .SetTokenType(TokenTypeIdentifiers.RefreshToken)
+                        .SetTokenId("60FFF7EA-F98E-437B-937E-5073CC313103")
+                        .SetAuthorizationId("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0")
+                        .SetClaim(Claims.Subject, "Bob le Bricoleur");
+
+                    return ValueTask.CompletedTask;
+                });
+
+                builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
+            });
+
+            options.Services.AddSingleton(CreateTokenManager(mock =>
+            {
+                var token = new OpenIddictToken();
+
+                mock.Setup(manager => manager.FindByIdAsync("60FFF7EA-F98E-437B-937E-5073CC313103", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(token);
+
+                mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("60FFF7EA-F98E-437B-937E-5073CC313103");
+
+                mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(TokenTypeIdentifiers.RefreshToken);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Redeemed, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(false);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+
+                mock.Setup(manager => manager.GetSessionIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5");
+            }));
+
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            GrantType = GrantTypes.TokenExchange,
+            SubjectToken = "8xLOxBtZp8",
+            SubjectTokenType = TokenTypeIdentifiers.RefreshToken
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidGrant, response.Error);
+        Assert.Equal(SR.GetResourceString(SR.ID2210), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2210), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByIdAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5", It.IsAny<CancellationToken>()), Times.Once());
+    }
+
+    [Fact]
+    public async Task ValidateToken_RequestIsRejectedWhenSessionAssociatedWithTokenIsInvalid()
+    {
+        // Arrange
+        var session = new OpenIddictSession();
+
+        var manager = CreateSessionManager(mock =>
+        {
+            mock.Setup(manager => manager.FindByIdAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5", It.IsAny<CancellationToken>()))
+                .ReturnsAsync(session);
+
+            mock.Setup(manager => manager.HasStatusAsync(session, Statuses.Valid, It.IsAny<CancellationToken>()))
+                .ReturnsAsync(false);
+        });
+
+        await using var server = await CreateServerAsync(options =>
+        {
+            options.AddEventHandler<ValidateTokenContext>(builder =>
+            {
+                builder.UseInlineHandler(context =>
+                {
+                    Assert.Equal("8xLOxBtZp8", context.Token);
+                    Assert.Equal([TokenTypeIdentifiers.RefreshToken], context.ValidTokenTypes);
+
+                    context.Principal = new ClaimsPrincipal(new ClaimsIdentity("Bearer"))
+                        .SetTokenType(TokenTypeIdentifiers.RefreshToken)
+                        .SetTokenId("60FFF7EA-F98E-437B-937E-5073CC313103")
+                        .SetSessionId("18D15F73-BE2B-6867-DC01-B3C1E8AFDED0")
+                        .SetClaim(Claims.Subject, "Bob le Bricoleur");
+
+                    return ValueTask.CompletedTask;
+                });
+
+                builder.SetOrder(ValidateIdentityModelToken.Descriptor.Order - 500);
+            });
+
+            options.Services.AddSingleton(CreateTokenManager(mock =>
+            {
+                var token = new OpenIddictToken();
+
+                mock.Setup(manager => manager.FindByIdAsync("60FFF7EA-F98E-437B-937E-5073CC313103", It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(token);
+
+                mock.Setup(manager => manager.GetIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("60FFF7EA-F98E-437B-937E-5073CC313103");
+
+                mock.Setup(manager => manager.GetTypeAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(TokenTypeIdentifiers.RefreshToken);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Redeemed, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(false);
+
+                mock.Setup(manager => manager.HasStatusAsync(token, Statuses.Valid, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync(true);
+
+                mock.Setup(manager => manager.GetSessionIdAsync(token, It.IsAny<CancellationToken>()))
+                    .ReturnsAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5");
+            }));
+
+            options.Services.AddSingleton(manager);
+        });
+
+        await using var client = await server.CreateClientAsync();
+
+        // Act
+        var response = await client.PostAsync("/connect/token", new OpenIddictRequest
+        {
+            ActorToken = "accVkjcJyb4BWCxGsndESCJQbdFMogUC5PbRDqceLTC",
+            ActorTokenType = TokenTypeIdentifiers.AccessToken,
+            GrantType = GrantTypes.TokenExchange,
+            SubjectToken = "8xLOxBtZp8",
+            SubjectTokenType = TokenTypeIdentifiers.RefreshToken
+        });
+
+        // Assert
+        Assert.Equal(Errors.InvalidGrant, response.Error);
+        Assert.Equal(SR.GetResourceString(SR.ID2210), response.ErrorDescription);
+        Assert.Equal(SR.FormatID8000(SR.ID2210), response.ErrorUri);
+
+        Mock.Get(manager).Verify(manager => manager.FindByIdAsync("DE7F0AF0-9595-4546-BE3D-F6BB43FB5FA5", It.IsAny<CancellationToken>()), Times.Once());
+        Mock.Get(manager).Verify(manager => manager.HasStatusAsync(session, Statuses.Valid, It.IsAny<CancellationToken>()), Times.Once());
+    }
 }

test/OpenIddict.Server.IntegrationTests/OpenIddictServerIntegrationTests.cs

@@ -5203,12 +5203,14 @@ public abstract partial class OpenIddictServerIntegrationTests
                        .SetDefaultAuthorizationEntity<OpenIddictAuthorization>()
                        .SetDefaultResourceEntity<OpenIddictResource>()
                        .SetDefaultScopeEntity<OpenIddictScope>()
+                       .SetDefaultSessionEntity<OpenIddictSession>()
                        .SetDefaultTokenEntity<OpenIddictToken>();
 
                 options.Services.AddSingleton(CreateApplicationManager())
                                 .AddSingleton(CreateAuthorizationManager())
                                 .AddSingleton(CreateResourceManager())
                                 .AddSingleton(CreateScopeManager())
+                                .AddSingleton(CreateSessionManager())
                                 .AddSingleton(CreateTokenManager());
             })
 
@@ -5343,6 +5345,20 @@ public abstract partial class OpenIddictServerIntegrationTests
         return manager.Object;
     }
 
+    protected OpenIddictSessionManager<OpenIddictSession> CreateSessionManager(
+        Action<Mock<OpenIddictSessionManager<OpenIddictSession>>>? configuration = null)
+    {
+        var manager = new Mock<OpenIddictSessionManager<OpenIddictSession>>(
+            Mock.Of<IOpenIddictSessionCache<OpenIddictSession>>(),
+            OutputHelper.ToLogger<OpenIddictSessionManager<OpenIddictSession>>(),
+            Mock.Of<IOptionsMonitor<OpenIddictCoreOptions>>(),
+            Mock.Of<IOpenIddictSessionStore<OpenIddictSession>>());
+
+        configuration?.Invoke(manager);
+
+        return manager.Object;
+    }
+
     protected OpenIddictTokenManager<OpenIddictToken> CreateTokenManager(
         Action<Mock<OpenIddictTokenManager<OpenIddictToken>>>? configuration = null)
     {
@@ -5361,5 +5377,6 @@ public abstract partial class OpenIddictServerIntegrationTests
     public class OpenIddictAuthorization;
     public class OpenIddictResource;
     public class OpenIddictScope;
+    public class OpenIddictSession;
     public class OpenIddictToken;
 }

test/OpenIddict.Validation.IntegrationTests/OpenIddictValidationIntegrationTests.cs

@@ -385,9 +385,11 @@ public abstract class OpenIddictValidationIntegrationTests
             .AddCore(options =>
             {
                 options.SetDefaultAuthorizationEntity<OpenIddictAuthorization>()
+                       .SetDefaultSessionEntity<OpenIddictSession>()
                        .SetDefaultTokenEntity<OpenIddictToken>();
 
                 options.Services.AddSingleton(CreateAuthorizationManager())
+                                .AddSingleton(CreateSessionManager())
                                 .AddSingleton(CreateTokenManager());
             })
 
@@ -435,6 +437,20 @@ public abstract class OpenIddictValidationIntegrationTests
         return manager.Object;
     }
 
+    protected OpenIddictSessionManager<OpenIddictSession> CreateSessionManager(
+        Action<Mock<OpenIddictSessionManager<OpenIddictSession>>>? configuration = null)
+    {
+        var manager = new Mock<OpenIddictSessionManager<OpenIddictSession>>(
+            Mock.Of<IOpenIddictSessionCache<OpenIddictSession>>(),
+            OutputHelper.ToLogger<OpenIddictSessionManager<OpenIddictSession>>(),
+            Mock.Of<IOptionsMonitor<OpenIddictCoreOptions>>(),
+            Mock.Of<IOpenIddictSessionStore<OpenIddictSession>>());
+
+        configuration?.Invoke(manager);
+
+        return manager.Object;
+    }
+
     protected OpenIddictTokenManager<OpenIddictToken> CreateTokenManager(
         Action<Mock<OpenIddictTokenManager<OpenIddictToken>>>? configuration = null)
     {
@@ -450,5 +466,6 @@ public abstract class OpenIddictValidationIntegrationTests
     }
 
     public class OpenIddictAuthorization;
+    public class OpenIddictSession;
     public class OpenIddictToken;
 }

test/OpenIddict.Validation.Tests/OpenIddictValidationConfigurationTests.cs

@@ -308,7 +308,7 @@ public class OpenIddictValidationConfigurationTests
     }
 
     [Fact]
-    public void Validate_ReturnsAnErrorWhenAuthorizationOrTokenEntryValidationIsEnabledInIntrospectionMode()
+    public void Validate_ReturnsAnErrorWhenAuthorizationEntryValidationIsEnabledInIntrospectionMode()
     {
         // Arrange
         var configuration = new OpenIddictValidationConfiguration(new ServiceCollection().BuildServiceProvider());
@@ -320,6 +320,49 @@ public class OpenIddictValidationConfigurationTests
         options.ClientId = "client_id";
         options.ClientSecret = "client_secret";
         options.EnableAuthorizationEntryValidation = true;
+        options.ConfigurationManager = new StaticConfigurationManager<OpenIddictConfiguration>(new OpenIddictConfiguration());
+
+        // Act
+        var result = configuration.Validate(name: null, options);
+
+        // Assert
+        Assert.Contains(SR.GetResourceString(SR.ID0133), result.Failures!, StringComparer.Ordinal);
+    }
+
+    [Fact]
+    public void Validate_ReturnsAnErrorWhenSessionEntryValidationIsEnabledInIntrospectionMode()
+    {
+        // Arrange
+        var configuration = new OpenIddictValidationConfiguration(new ServiceCollection().BuildServiceProvider());
+        var options = CreateBaseOptions();
+
+        options.ValidationType = OpenIddictValidationType.Introspection;
+        options.Issuer = new Uri("https://www.contoso.com/");
+        options.ConfigurationEndpoint = new Uri("https://www.contoso.com/.well-known/openid-configuration");
+        options.ClientId = "client_id";
+        options.ClientSecret = "client_secret";
+        options.EnableSessionEntryValidation = true;
+        options.ConfigurationManager = new StaticConfigurationManager<OpenIddictConfiguration>(new OpenIddictConfiguration());
+
+        // Act
+        var result = configuration.Validate(name: null, options);
+
+        // Assert
+        Assert.Contains(SR.GetResourceString(SR.ID0133), result.Failures!, StringComparer.Ordinal);
+    }
+
+    [Fact]
+    public void Validate_ReturnsAnErrorWhenTokenEntryValidationIsEnabledInIntrospectionMode()
+    {
+        // Arrange
+        var configuration = new OpenIddictValidationConfiguration(new ServiceCollection().BuildServiceProvider());
+        var options = CreateBaseOptions();
+
+        options.ValidationType = OpenIddictValidationType.Introspection;
+        options.Issuer = new Uri("https://www.contoso.com/");
+        options.ConfigurationEndpoint = new Uri("https://www.contoso.com/.well-known/openid-configuration");
+        options.ClientId = "client_id";
+        options.ClientSecret = "client_secret";
         options.EnableTokenEntryValidation = true;
         options.ConfigurationManager = new StaticConfigurationManager<OpenIddictConfiguration>(new OpenIddictConfiguration());
 
@@ -328,7 +371,6 @@ public class OpenIddictValidationConfigurationTests
 
         // Assert
         Assert.Contains(SR.GetResourceString(SR.ID0133), result.Failures!, StringComparer.Ordinal);
-        Assert.Contains(SR.GetResourceString(SR.ID0134), result.Failures!, StringComparer.Ordinal);
     }
 
     [Fact]