#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation')

## IRevocationCutoffChecker Interface

Decides whether a subject\- or session\-level revocation cutoff refuses a token\.

```csharp
public interface IRevocationCutoffChecker
```

Derived  
↳ [RevocationCutoffChecker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.RevocationCutoffChecker 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.RevocationCutoffChecker')

### Remarks
Separate from the validator that consults it because the two answer different questions from different
stores\. The validator asks what is recorded about this one token; a cutoff is a fact about the principal,
and answering it means naming the issuer, opening a pairwise pseudonym and allowing for the clock of
whichever instance recorded the revocation\. Keeping that here also lets it be exercised on its own,
without a token registry and an inner validator standing in the way of every case\.
### Methods

## IRevocationCutoffChecker\.CheckAsync\(JsonWebTokenPayload\) Method {#Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker.CheckAsync(Abblix.Jwt.JsonWebTokenPayload)}

The refusal a cutoff calls for on this token, or `null` when no cutoff reaches it\.

```csharp
System.Threading.Tasks.Task<Abblix.Jwt.JwtValidationError?> CheckAsync(Abblix.Jwt.JsonWebTokenPayload payload);
```
#### Parameters

###### `payload` [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') {#Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker.CheckAsync(Abblix.Jwt.JsonWebTokenPayload).payload}

The payload of a token that has already passed signature and lifetime checks\.

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
A validation error when the token is refused, otherwise `null`\.

## IRevocationCutoffChecker\.IsSessionRefusedAsync\(AuthSession\) Method {#Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker.IsSessionRefusedAsync(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession)}

Whether a cutoff refuses this authentication session, so nothing may mint against it\.

```csharp
System.Threading.Tasks.Task<bool> IsSessionRefusedAsync(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession session);
```
#### Parameters

###### `session` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker.IsSessionRefusedAsync(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).session}

A session about to be used: one the authorization endpoint is considering
            reusing, or the one a grant presented at the token endpoint was authorized from\.

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')  
`true` when the session must not be used\.

### Remarks
Without this the token side alone is half a control\. A cutoff refuses tokens already issued, and
`iat` is stamped afresh by every new authorization, so a browser session the revocation never
touched can mint a replacement that clears the cutoff on the first try \- and keeps doing so\.

Measured against [AuthenticationTime](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession#Abblix.Oidc.Server.Features.UserAuthentication.AuthSession.AuthenticationTime 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession\.AuthenticationTime'), not against a flag. A sign-in after
the suspension is lifted produces a later authentication time and passes, which is the same property
that lets a revoked subject sign in again with nothing to clean up. A boolean would refuse the fresh
session too, and since the host's new session carries the same subject the request would loop back
here for as long as the record is kept.