How to revoke all jwt tokens for a specific user?

Question

I know an access token is self-contained and therefore can't be revoked. To my understanding, this is why the expiration time of an access token often is low. This enables one to revoke the refresh token, and thereby only allow users to be signed in, for the expiration time of the access token.

However, if I understand it correctly, a user is able to renew his token infinitely without the use of the refresh token.

One can initiate a silent authentication request by adding prompt=none. This is possible as long as your access token is still valid. Doing so will return a new access token, that is indistinguishable from a login performed directly without the prompt=none parameter.

If I understand this correctly, a user who once got a valid token is able to constantly renew this without me being able to "revoke" his access in any way?

Am I understanding this correctly, and if so, how do I go about revoking a user's access until he manually signs in again?

Answer 1

The prompt=none silent renewal actually uses the user's IDP authentication cookie and not their access token.

The good news is that ASP.Net Core allows you to store the data held in said cookie on the serverside (e.g. in a database or distributed cache) and thus you can revoke said cookie any time you like. By deleting the cookie data related to that user account you effectively invalidate their current session(s) and thus can prevent any future silent renewals. Likewise you can delete all persisted grants (reference tokens and refresh tokens).

Check out the Microsoft.AspNetCore.Authentication.Cookies.ITicketStore interface and the CookieAuthenticationOptions.SessionStore property.