#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation')

## ITokenRevoker Interface

Cuts off an end user, or one session, at a moment: the tokens issued before it stop working, and the
browser session behind them stops being usable to mint more\.

```csharp
public interface ITokenRevoker
```

Derived  
↳ [TokenRevoker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.TokenRevoker 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.TokenRevoker')

### Remarks
The library owns the enforcement and the host owns the occasion\. An account suspension, a password change
or an administrator signing a user out of everything are all host events this server never learns of, so
this is where the host says when\.

RFC 7009 is not this surface: that endpoint revokes one token a client presents, which is a different act
with a different actor. Nothing here is reachable by a client.

What a revocation actually reaches depends on how a token is validated. A refresh token is presented back
to this server on every use, so the next refresh fails. An access token that a resource server introspects
comes back inactive. An access token the resource server validates by itself, checking only the signature
and the expiry, never reaches this server at all and stays usable until it expires - which is what short
access-token lifetimes are for.
### Methods

## ITokenRevoker\.RevokeSessionAsync\(string, Nullable\<DateTimeOffset\>, CancellationToken\) Method {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSessionAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken)}

Cuts one session off at [before](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSessionAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).before 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.ITokenRevoker\.RevokeSessionAsync\(string, System\.Nullable\<System\.DateTimeOffset\>, System\.Threading\.CancellationToken\)\.before'), leaving the same user's other sessions alone\.

```csharp
System.Threading.Tasks.Task RevokeSessionAsync(string sessionId, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `sessionId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSessionAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).sessionId}

The session identifier the tokens carry\.

###### `before` [System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSessionAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).before}

The moment to revoke up to; the current time when omitted\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSessionAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).cancellationToken}

Cancels the write\.

#### Returns
[System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task')  
A task that completes once the revocation is recorded\.

### Remarks
The session stops being reusable as well as its tokens stopping, so this ends that sign\-in for the
purposes of this server\. It does not clear the cookie carrying it \- that belongs to whoever holds the
browser, and this call is made by somebody else\.

## ITokenRevoker\.RevokeSubjectAsync\(string, Nullable\<DateTimeOffset\>, CancellationToken\) Method {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSubjectAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken)}

Cuts this subject off at [before](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSubjectAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).before 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.ITokenRevoker\.RevokeSubjectAsync\(string, System\.Nullable\<System\.DateTimeOffset\>, System\.Threading\.CancellationToken\)\.before'), across every session they hold\.

```csharp
System.Threading.Tasks.Task RevokeSubjectAsync(string subject, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));
```
#### Parameters

###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSubjectAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).subject}

The subject identifier the tokens carry\.

###### `before` [System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSubjectAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).before}

The moment to cut off at; the current time when omitted\. Tokens issued at or
            after it are unaffected, so the user signing in again works with nothing to undo\.

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker.RevokeSubjectAsync(string,System.Nullable_System.DateTimeOffset_,System.Threading.CancellationToken).cancellationToken}

Cancels the write\.

#### Returns
[System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task')  
A task that completes once the revocation is recorded\.

### Remarks
Two things stop\. Every token issued to them earlier is refused on its next use, and every browser
session authenticated earlier stops being reusable, so the authorization endpoint will not mint a
replacement against one\. Signing in again works immediately and leaves nothing to clean up: the new
session is later than the cutoff and passes\. Its tokens follow once
[RevocationCutoffSkew](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevocationCutoffSkew 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RevocationCutoffSkew') has elapsed, since inside that
window a freshly minted token cannot be told from one whose clock ran ahead\.