Token revocation

A client that has finished with a token tells the server to revoke it, and from then on the token is inactive. A reference token (an opaque handle the server looks up) is the case where that is immediate everywhere, because every API has to ask the server about it; the demo host's reference-machine client is issued reference tokens. The API is api-resource. A refresh token is revoked the same way.

Follows: RFC 7009, RFC 7662.

Recorded from the demo host (src/Fdyay.IdentityServer.Host) by the RevocationFlow test on every CI run. A value in braces, such as {access_token_1}, is one that differs on every run; the same placeholder is the same value wherever it appears. See how these pages are made.

sequenceDiagram
    participant Client
    participant AuthorizationServer as Authorization Server
    participant API
    Client->>AuthorizationServer: POST /connect/token
    AuthorizationServer-->>Client: 200 OK
    API->>AuthorizationServer: POST /connect/introspect
    AuthorizationServer-->>API: 200 OK
    Client->>AuthorizationServer: POST /connect/revocation
    AuthorizationServer-->>Client: 200 OK
    API->>AuthorizationServer: POST /connect/introspect
    AuthorizationServer-->>API: 200 OK

1. The client gets a reference token

Not a JWT: an opaque handle.

Client → Authorization Server

POST /connect/token HTTP/1.1
Authorization: Basic cmVmZXJlbmNlLW1hY2hpbmU6c2VjcmV0
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&scope=api

Authorization Server → Client

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
Cache-Control: no-store, no-cache, max-age=0
Pragma: no-cache

{
  "access_token": "{access_token_1}",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "api"
}

2. The API introspects it

It is active.

API → Authorization Server

POST /connect/introspect HTTP/1.1
Authorization: Basic YXBpLXJlc291cmNlOmFwaS1zZWNyZXQ=
Content-Type: application/x-www-form-urlencoded

token={access_token_1}

Authorization Server → API

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
Cache-Control: no-store, no-cache, max-age=0
Pragma: no-cache

{
  "active": true,
  "client_id": "reference-machine",
  "scope": "api",
  "aud": "api-resource"
}

3. The client revokes it

The answer is 200 whether or not the token existed, so the endpoint cannot be used to test tokens.