Performance and Security Analysis of OAuth 2.0 Token Propagation in Spring Boot Microservices

Abstract

This research work evaluates the performance and security implications of OAuth 2.0 token propagation in Spring Boot microservices. Six propagation and validation strategies were tested: local JWT validation, direct token forwarding, gateway relay, per-request introspection, per-request token exchange, and token exchange with a one-second cache. The controlled experiment used Spring Boot 3.5.16 and OpenJDK 17 across four concurrency levels and ten randomized blocks comprising 120,000 measured requests. All 42 predefine behavioural security checks passed and all requests completed successfully. At concurrency 50, local JWT validation achieved a mean batch p95 latency of 8.63 ms and a throughput of 7066.75 requests/s at concurrency 50. Per-request exchange yielded 112.99 ms and 1148.70 requests/s, respectively ,whereas cached exchange yielded 23.12 ms and 3677.18 requests/s. Caching reduced exchanged calls from 500 to approximately one per 500 requests batch. Within this single-caller workload, the findings support selective token exchange at authority boundaries and local validation when tokens carry the appropriate audience and scope.