Reputation: 363
I am using IdentityServer 4
implicit flow with reference tokens.
I made an own implementation of IPersistedGrantStore which stores grants in a MSSQL database, which works fine.
Now I´d like to revoke a reference token on user logout from the frontend. Because I don´t want to call the revocation endpoint from the frontend I´d like to do it implicitly in the AccountController.Logout(string logoutId)
method in the IdentityServer (this would also cover a logout from swagger ui).
So I injected an IIdentityServerInteractionService into the AccountController, but when I call
await _interaction.RevokeTokensForCurrentSessionAsync();
in the LogOut-Method
it revokes ALL tokens for the current subjectid/user and clientid (the method IPersistedGrantStore.RemoveAllAsync(string subjectId, string clientId)
is called).
But I´d like to just revoke the token of the one specific session (the method is called RevokeTokensForCurrentSession
Async after all) which was logged off.
Another approach would be to call TokenRevocationClient.RevokeAsync
for which I would need the exact token to pass. But in AccountController.LogOut
I
only have the logoutid and the LogoutRequest (which also does not contain the actual token).
So what is the best solution to implicitly revoke a specific
access (reference) token on user logout?
Thanks in advance...
Upvotes: 4
Views: 1175