Your current implementation of the introspection_endpoint for OpenID Connect follows the [RFC7662](https://www.rfc-editor.org/rfc/rfc7662.txt) specification by including the required field “active”, as well as the optional fields “exp”, and “iat”. We request you include the additional optional fields “scope”, “client_id”, “username”, “sub”, “aud”, and “iss”. This will allow Relying Parties to better validate access tokens and mitigate the “[Access Token Redirect](http://openid.net/specs/openid-connect-core-1_0.html#AccessTokenRedirect)”, and other [confused deputy](https://en.wikipedia.org/wiki/Confused_deputy_problem) type attacks, by exposing the requisite data on a single endpoint.