Adding Application Specific claim after Web API Authentication (Identity Server)

Question

I am adding application specific claims in my Web Application OnValidateIdentity to Identity Sever's access token claims. I am grabbing the application specific claims for the logged in user querying the Database for every API call. Should I make the application specific claims to be injected in the token in Identity Server (to reduce the DB calls)?

Answer 1

Identity Server Token should only contain claims about the user. It should be ok to query the application specific claims when the token received. You can introduce a caching layer to reduce DB calls if that is a concern.

But if you have really valid reason these rules can be broken and add application-specific claims at identity server. (e.g: settings shared by multiple apps).