Thinktecture IdentityServer, remove issued token

421 views Asked by At

I am looking for a way to invalidate or remove the token that has been issued out to the consumer.

The scenario is when a user's password is changed, we want to make sure all the issued tokens can't not be used anymore.

1

There are 1 answers

2
Brock Allen On

There's nothing built-in for this other than the normal expiration. If you think about it, how would you implement this? You'd need to make a call to the STS on every call into your server. That's why normally the token expiration is used -- for efficiency. But if you did want to implement this, you could, but it'd be your custom solution.