Invalidate access token #10893

2 Answer(s)

• 

  0

  AI-Bot created 16 hours ago

  Support Team ABP Agent

  • In ABP (with OpenIddict/IdentityServer-style JWT access tokens), you generally can’t “invalidate” an already-issued JWT access token server-side unless your APIs introspect tokens (reference tokens) or you keep a server-side denylist and check it on every request. A JWT is self-contained and remains valid until it expires.

  • The recommended approach to “log the user out everywhere” is:

    1. Revoke the user’s refresh token(s) (so no new access token can be obtained), and
    2. Sign the user out of the browser session (cookie), and
    3. Keep short access token lifetime so existing access tokens die quickly.

  • If your goal is “call something from the app server and force the browser user to be logged out”:

    • Calling /connect/revocation from your app server can revoke refresh tokens (depending on your OpenIddict/IdentityServer configuration), but it does not immediately invalidate an already-issued JWT access token that the SPA is currently using.
    • To make the browser UI reflect logout immediately, you must also end the cookie session (server-side sign-out) and have the client clear its stored tokens / trigger re-authentication.

  • If you truly need immediate access token invalidation, use access token introspection (so the API asks the auth server if the token is still active on each call). ABP support confirms using token introspection to address token/session desync scenarios:

    • Enable introspection in your API authentication configuration (exact code depends on your ABP version and hosting model), then revoking the token on the auth server can take effect immediately at the API.

  Sources (validated):

  • https://abp.io/support/questions/5071
  • https://github.com/abpframework/abp/pull/15876
  • https://github.com/abpframework/abp/pull/16504

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 15 hours ago

  Support Team Fullstack Developer

  Hi,

  /connect/revocat makes that token invalid right away. The next API call with it returns 401, and its refresh token stops working too. But it only ends the session that this token belongs to.

  The auth server login cookie has its own session. So after your app logs the user out, the next login goes through the auth server, and it signs the user back in without asking for the password.

  To log the user out of the browser, revoke all of their sessions from your app server with IdentitySessionManager:

  using System;
  using System.Threading.Tasks;
  using Volo.Abp.DependencyInjection;
  using Volo.Abp.Identity;
  using Volo.Abp.MultiTenancy;
  
  namespace MyCompanyName.MyProjectName;
  
  public class UserLogoutService : ITransientDependency
  {
      private readonly IdentitySessionManager _identitySessionManager;
      private readonly ICurrentTenant _currentTenant;
  
      public UserLogoutService(IdentitySessionManager identitySessionManager, ICurrentTenant currentTenant)
      {
          _identitySessionManager = identitySessionManager;
          _currentTenant = currentTenant;
      }
  
      public async Task LogoutAsync(Guid userId, Guid? tenantId)
      {
          using (_currentTenant.Change(tenantId))
          {
              await _identitySessionManager.RevokeAllAsync(userId);
          }
      }
  }
  

  Pass null as tenantId for host users. This logs the user out on all devices. Their next request gets a 401, and they have to sign in again.

  Some notes:

  • This is the Session Management feature of the Identity Pro module (ABP 8.2+). It needs dynamic claims (IsDynamicClaimsEnabled = true and app.UseDynamicClaims()), which the startup templates enable by default.
  • If you run more than one host or instance, they all need to use the same distributed cache, like Redis. Otherwise the other instances still see the session in their local cache.
  • If you only want to end some of the sessions, use GetListAsync(userId: userId) and RevokeAsync(session) of the same manager.
  • Admins can also do this from the UI: Identity > Users > Actions > Sessions, then Log out on a session.

  https://abp.io/docs/latest/modules/identity/session-management

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel