RevocationRetentionOptionsValidator Class

Fails at startup on a revocation setting that would let a revocation report success and do nothing.

public sealed class RevocationRetentionOptionsValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions>

Inheritance System.Object → RevocationRetentionOptionsValidator

Implements Microsoft.Extensions.Options.IValidateOptions<OidcOptions>

Remarks

A revocation is one record with an expiry. At zero or below, the record expires as it is written, so RevokeSubjectAsync returns successfully and the tokens it was called about keep working - a security control that reports success and does nothing, which is the shape that gets discovered by an incident rather than by a test.

Only the value that can never work is rejected. A value that is merely too short for a deployment's longest-lived refresh token cannot be detected here: token lifetimes are per client and the client store is not enumerable, so nothing at startup knows what the longest one is.