Class TokenRevocationResponseGenerator

Namespace

Fdyay.IdentityServer.ResponseHandling

Assembly

Fdyay.IdentityServer.Core.dll

Duende's default revocation response generator.

public class TokenRevocationResponseGenerator : ITokenRevocationResponseGenerator

Inheritance

object

TokenRevocationResponseGenerator

Implements

ITokenRevocationResponseGenerator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

TokenRevocationResponseGenerator(IReferenceTokenStore, IRefreshTokenStore)

public TokenRevocationResponseGenerator(IReferenceTokenStore referenceTokens, IRefreshTokenStore refreshTokens)

Parameters

referenceTokens IReferenceTokenStore

refreshTokens IRefreshTokenStore

Remarks

The constructor this had before 0.167.0, kept: the options read as the defaults.

TokenRevocationResponseGenerator(IReferenceTokenStore, IRefreshTokenStore, IOptions<IdentityServerOptions>?)

[ActivatorUtilitiesConstructor]
public TokenRevocationResponseGenerator(IReferenceTokenStore referenceTokens, IRefreshTokenStore refreshTokens, IOptions<IdentityServerOptions>? options)

Parameters

referenceTokens IReferenceTokenStore

Where reference access tokens are kept.

refreshTokens IRefreshTokenStore

Where refresh tokens are kept.

options IOptions<IdentityServerOptions>

The server's options, for ConsumedRefreshTokenGracePeriod. Null reads as the defaults.

Remarks

New in 0.167.0, an overload rather than a parameter added to the one above. The one the container builds, as the longer and as marked for ActivatorUtilities.

Properties

ReferenceTokens

Where reference access tokens are kept.

protected IReferenceTokenStore ReferenceTokens { get; }

Property Value

IReferenceTokenStore

RefreshTokens

Where refresh tokens are kept.

protected IRefreshTokenStore RefreshTokens { get; }

Property Value

IRefreshTokenStore

Methods

ProcessAsync(TokenRevocationRequestValidationResult, CancellationToken)

Revokes the token the validated request names, when it is one of the client's.

public virtual Task<TokenRevocationResponse> ProcessAsync(TokenRevocationRequestValidationResult validationResult, CancellationToken ct)

Parameters

validationResult TokenRevocationRequestValidationResult

The validated revocation request: the token, its type hint and the client.

ct CancellationToken

Cancels the store lookups and removals.

Returns

Task<TokenRevocationResponse>

Whether a token was revoked, and which kind.

Exceptions

ArgumentNullException

validationResult is null.

RevokeAccessTokenAsync(TokenRevocationRequestValidationResult, CancellationToken)

Revokes the token as a reference access token of the client's, answering whether it was one.

protected virtual Task<bool> RevokeAccessTokenAsync(TokenRevocationRequestValidationResult validationResult, CancellationToken ct)

Parameters

validationResult TokenRevocationRequestValidationResult

ct CancellationToken

Returns

Task<bool>

RevokeRefreshTokenAsync(TokenRevocationRequestValidationResult, CancellationToken)

Revokes the token as a refresh token of the client's, answering whether it was one.

protected virtual Task<bool> RevokeRefreshTokenAsync(TokenRevocationRequestValidationResult validationResult, CancellationToken ct)

Parameters

validationResult TokenRevocationRequestValidationResult

ct CancellationToken

Returns

Task<bool>

Remarks

The reference access tokens issued beside it in the same session go with it: they were obtained on the strength of the grant being revoked, and RFC 7009 §2.1 lets a server revoke them for that reason.

With ConsumedRefreshTokenGracePeriod on, so does its lineage — the tokens it was rotated from and any fork, as a replay revokes them. Ours: Duende's removes the one handle, which with a window open would leave the token it was rotated from acceptable, and so a way back into a session its client has just ended. With the window off, the one handle, as Duende's.