TokenRevoker Class
Records a revocation as a cutoff against the principal, which is one write however many tokens it invalidates.
public class TokenRevoker : Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevokerInheritance System.Object → TokenRevoker
Implements ITokenRevoker
Constructors
TokenRevoker(ILogger<TokenRevoker>, IRevocationCutoffRegistry, IOptions<OidcOptions>, TimeProvider) Constructor
Records a revocation as a cutoff against the principal, which is one write however many tokens it invalidates.
public TokenRevoker(Microsoft.Extensions.Logging.ILogger<Abblix.Oidc.Server.Features.Tokens.Revocation.TokenRevoker> logger, Abblix.Oidc.Server.Features.Storages.IRevocationCutoffRegistry cutoffRegistry, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options, System.TimeProvider clock);Parameters
logger Microsoft.Extensions.Logging.ILogger<TokenRevoker>
Records each cutoff written, which is the only trace a revocation leaves.
cutoffRegistry IRevocationCutoffRegistry
Where the cutoff is kept.
options Microsoft.Extensions.Options.IOptions<OidcOptions>
Supplies how long a cutoff is retained.
clock System.TimeProvider
Supplies the current moment when the caller names none.
Methods
TokenRevoker.RevokeSessionAsync(string, Nullable<DateTimeOffset>, CancellationToken) Method
Cuts one session off at before, leaving the same user's other sessions alone.
public System.Threading.Tasks.Task RevokeSessionAsync(string sessionId, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
sessionId System.String
The session identifier the tokens carry.
before System.Nullable<System.DateTimeOffset>
The moment to revoke up to; the current time when omitted.
cancellationToken System.Threading.CancellationToken
Cancels the write.
Implements RevokeSessionAsync(string, Nullable<DateTimeOffset>, CancellationToken)
Returns
System.Threading.Tasks.Task
A task that completes once the revocation is recorded.
Remarks
The session stops being reusable as well as its tokens stopping, so this ends that sign-in for the purposes of this server. It does not clear the cookie carrying it - that belongs to whoever holds the browser, and this call is made by somebody else.
TokenRevoker.RevokeSubjectAsync(string, Nullable<DateTimeOffset>, CancellationToken) Method
Cuts this subject off at before, across every session they hold.
public System.Threading.Tasks.Task RevokeSubjectAsync(string subject, System.Nullable<System.DateTimeOffset> before=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
subject System.String
The subject identifier the tokens carry.
before System.Nullable<System.DateTimeOffset>
The moment to cut off at; the current time when omitted. Tokens issued at or after it are unaffected, so the user signing in again works with nothing to undo.
cancellationToken System.Threading.CancellationToken
Cancels the write.
Implements RevokeSubjectAsync(string, Nullable<DateTimeOffset>, CancellationToken)
Returns
System.Threading.Tasks.Task
A task that completes once the revocation is recorded.
Remarks
Two things stop. Every token issued to them earlier is refused on its next use, and every browser session authenticated earlier stops being reusable, so the authorization endpoint will not mint a replacement against one. Signing in again works immediately and leaves nothing to clean up: the new session is later than the cutoff and passes. Its tokens follow once RevocationCutoffSkew has elapsed, since inside that window a freshly minted token cannot be told from one whose clock ran ahead.