Revoke Keycloak access token

Question

I am using Keycloak to secure my react front-end and node.js back-end. These clients are protected using role based authorization.

My front-end application registered in Keycloak as a public client and back-end registered as bearer only client. When a user logging in to the front-end, i am taking the access token for that particular user and i am using that access token to call back-end api layer.

When user logout from the front-end i am clearing the front-end client session of that particular user from Keycloak by using keycloak object logout method. That is working fine and user is logging out and redirected to the Keycloak login page.

But the issue is i can still use the access token of that logged out user to call back-end api. The access token is still valid even though the user logged out.

I tried this end point to revoke the user access token. But didn't work /auth/admin/realms//users/

Is there a way to revoke the access token of a particular user in Keycloak ?

Answer 1

I think you can only revoke sessions but not issued access tokens. So the only solution for this is to choose a very short access token life span in combination with silent refresh, so the usability is still good and the maximum access time after session revocation is equal or less than token life span.

EDIT: There is an official guide about how to handle compromised tokens. They do not mention how to revoke an individual access token, so there is no documented way to do so. However, you can revoke all issued access keys by the described "not_before" way.

Answer 2

You could call the following endpoint to revoke an access token using a post

{serverName}/auth/realms/{realmName}/protocol/openid-connect/revoke