I’m primarily worried about OAuth2, where resource...

# server

[orangy]

I’m primarily worried about OAuth2, where resource server has to go to authorisation server to validate access token. In highload scenario there could be numerous http client requests, and they better be fully async. Async streaming is not very important here, since payload is tiny, but connecting and waiting for response should better not hold a thread.