ITokenRevoker Interface
Cuts off an end user, or one session, at a moment: the tokens issued before it stop working, and the browser session behind them stops being usable to mint more.
public interface ITokenRevokerDerived
↳ TokenRevoker
Remarks
The library owns the enforcement and the host owns the occasion. An account suspension, a password change or an administrator signing a user out of everything are all host events this server never learns of, so this is where the host says when.
RFC 7009 is not this surface: that endpoint revokes one token a client presents, which is a different act with a different actor. Nothing here is reachable by a client.
What a revocation actually reaches depends on how a token is validated. A refresh token is presented back to this server on every use, so the next refresh fails. An access token that a resource server introspects comes back inactive. An access token the resource server validates by itself, checking only the signature and the expiry, never reaches this server at all and stays usable until it expires - which is what short access-token lifetimes are for.
Methods
ITokenRevoker.RevokeSessionAsync(string, Nullable<DateTimeOffset>, CancellationToken) Method
Cuts one session off at before, leaving the same user's other sessions alone.
System.Threading.Tasks.Task RevokeSessionAsync(string sessionId, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
sessionId System.String
The session identifier the tokens carry.
before System.Nullable<System.DateTimeOffset>
The moment to revoke up to; the current time when omitted.
cancellationToken System.Threading.CancellationToken
Cancels the write.
Returns
System.Threading.Tasks.Task
A task that completes once the revocation is recorded.
Remarks
The session stops being reusable as well as its tokens stopping, so this ends that sign-in for the purposes of this server. It does not clear the cookie carrying it - that belongs to whoever holds the browser, and this call is made by somebody else.
ITokenRevoker.RevokeSubjectAsync(string, Nullable<DateTimeOffset>, CancellationToken) Method
Cuts this subject off at before, across every session they hold.
System.Threading.Tasks.Task RevokeSubjectAsync(string subject, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
subject System.String
The subject identifier the tokens carry.
before System.Nullable<System.DateTimeOffset>
The moment to cut off at; the current time when omitted. Tokens issued at or after it are unaffected, so the user signing in again works with nothing to undo.
cancellationToken System.Threading.CancellationToken
Cancels the write.
Returns
System.Threading.Tasks.Task
A task that completes once the revocation is recorded.
Remarks
Two things stop. Every token issued to them earlier is refused on its next use, and every browser session authenticated earlier stops being reusable, so the authorization endpoint will not mint a replacement against one. Signing in again works immediately and leaves nothing to clean up: the new session is later than the cutoff and passes. Its tokens follow once RevocationCutoffSkew has elapsed, since inside that window a freshly minted token cannot be told from one whose clock ran ahead.