Revoke/Reject valid Json Web Token in ASP.NET core middleware for locked out users
I am using the JWT middleware + ASP.NET Identity to establish a simple User/Password login in my ASP.NET Core WebAPI project.
The tokens will be valid for 15 minutes. I think I will be utilizing the Refresh Token concept to keep the user logged in, when he is still browsing the site (SPA) or using the mobile app (What about a remember me option? I would create a token that's valid for a month maybe?)
So, is there any way to revoke a generated token? I am think about checking (on each request) if the user still has the right to access the API. Maybe there is another way to handle these cases?
I see a AspNetUserTokens table. Maybe there is a way to store the JWT in there automatically?! At the moment I am using ASP.NET Identity just for user authentication.
asp.net jwt asp.net-core-webapi
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
add a comment |
I am using the JWT middleware + ASP.NET Identity to establish a simple User/Password login in my ASP.NET Core WebAPI project.
The tokens will be valid for 15 minutes. I think I will be utilizing the Refresh Token concept to keep the user logged in, when he is still browsing the site (SPA) or using the mobile app (What about a remember me option? I would create a token that's valid for a month maybe?)
So, is there any way to revoke a generated token? I am think about checking (on each request) if the user still has the right to access the API. Maybe there is another way to handle these cases?
I see a AspNetUserTokens table. Maybe there is a way to store the JWT in there automatically?! At the moment I am using ASP.NET Identity just for user authentication.
asp.net jwt asp.net-core-webapi
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
add a comment |
I am using the JWT middleware + ASP.NET Identity to establish a simple User/Password login in my ASP.NET Core WebAPI project.
The tokens will be valid for 15 minutes. I think I will be utilizing the Refresh Token concept to keep the user logged in, when he is still browsing the site (SPA) or using the mobile app (What about a remember me option? I would create a token that's valid for a month maybe?)
So, is there any way to revoke a generated token? I am think about checking (on each request) if the user still has the right to access the API. Maybe there is another way to handle these cases?
I see a AspNetUserTokens table. Maybe there is a way to store the JWT in there automatically?! At the moment I am using ASP.NET Identity just for user authentication.
asp.net jwt asp.net-core-webapi
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
I am using the JWT middleware + ASP.NET Identity to establish a simple User/Password login in my ASP.NET Core WebAPI project.
The tokens will be valid for 15 minutes. I think I will be utilizing the Refresh Token concept to keep the user logged in, when he is still browsing the site (SPA) or using the mobile app (What about a remember me option? I would create a token that's valid for a month maybe?)
So, is there any way to revoke a generated token? I am think about checking (on each request) if the user still has the right to access the API. Maybe there is another way to handle these cases?
I see a AspNetUserTokens table. Maybe there is a way to store the JWT in there automatically?! At the moment I am using ASP.NET Identity just for user authentication.
asp.net jwt asp.net-core-webapi
asp.net jwt asp.net-core-webapi
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
asked Nov 13 '18 at 9:40
DoubleVoidDoubleVoid
368628
368628
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
You can refer to this article : http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/
Once the user obtains long lived access token he’ll be able to access the server resources as long as his access token is not expired, there is no standard way to revoke access tokens unless the Authorization Server implements custom logic which forces you to store generated access token in database and do database checks with each request. But with refresh tokens, a system admin can revoke access by simply deleting the refresh token identifier from the database so once the system requests new access token using the deleted refresh token, the Authorization Server will reject this request because the refresh token is no longer available (we’ll come into this with more details).
The simple way is to issue short lived access tokens ,if you want to revoke the user , revoke the refresh token as the article shows , clear refresh token and access token on client side . Of cause , access token is still active until it expires .
Another way is to use Identity Server 4 Reference Tokens :
http://docs.identityserver.io/en/release/topics/reference_tokens.html
IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client. The API receiving this reference must then open a back-channel communication to IdentityServer to validate the token
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53278004%2frevoke-reject-valid-json-web-token-in-asp-net-core-middleware-for-locked-out-use%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You can refer to this article : http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/
Once the user obtains long lived access token he’ll be able to access the server resources as long as his access token is not expired, there is no standard way to revoke access tokens unless the Authorization Server implements custom logic which forces you to store generated access token in database and do database checks with each request. But with refresh tokens, a system admin can revoke access by simply deleting the refresh token identifier from the database so once the system requests new access token using the deleted refresh token, the Authorization Server will reject this request because the refresh token is no longer available (we’ll come into this with more details).
The simple way is to issue short lived access tokens ,if you want to revoke the user , revoke the refresh token as the article shows , clear refresh token and access token on client side . Of cause , access token is still active until it expires .
Another way is to use Identity Server 4 Reference Tokens :
http://docs.identityserver.io/en/release/topics/reference_tokens.html
IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client. The API receiving this reference must then open a back-channel communication to IdentityServer to validate the token
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
add a comment |
You can refer to this article : http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/
Once the user obtains long lived access token he’ll be able to access the server resources as long as his access token is not expired, there is no standard way to revoke access tokens unless the Authorization Server implements custom logic which forces you to store generated access token in database and do database checks with each request. But with refresh tokens, a system admin can revoke access by simply deleting the refresh token identifier from the database so once the system requests new access token using the deleted refresh token, the Authorization Server will reject this request because the refresh token is no longer available (we’ll come into this with more details).
The simple way is to issue short lived access tokens ,if you want to revoke the user , revoke the refresh token as the article shows , clear refresh token and access token on client side . Of cause , access token is still active until it expires .
Another way is to use Identity Server 4 Reference Tokens :
http://docs.identityserver.io/en/release/topics/reference_tokens.html
IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client. The API receiving this reference must then open a back-channel communication to IdentityServer to validate the token
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
add a comment |
You can refer to this article : http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/
Once the user obtains long lived access token he’ll be able to access the server resources as long as his access token is not expired, there is no standard way to revoke access tokens unless the Authorization Server implements custom logic which forces you to store generated access token in database and do database checks with each request. But with refresh tokens, a system admin can revoke access by simply deleting the refresh token identifier from the database so once the system requests new access token using the deleted refresh token, the Authorization Server will reject this request because the refresh token is no longer available (we’ll come into this with more details).
The simple way is to issue short lived access tokens ,if you want to revoke the user , revoke the refresh token as the article shows , clear refresh token and access token on client side . Of cause , access token is still active until it expires .
Another way is to use Identity Server 4 Reference Tokens :
http://docs.identityserver.io/en/release/topics/reference_tokens.html
IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client. The API receiving this reference must then open a back-channel communication to IdentityServer to validate the token
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
You can refer to this article : http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/
Once the user obtains long lived access token he’ll be able to access the server resources as long as his access token is not expired, there is no standard way to revoke access tokens unless the Authorization Server implements custom logic which forces you to store generated access token in database and do database checks with each request. But with refresh tokens, a system admin can revoke access by simply deleting the refresh token identifier from the database so once the system requests new access token using the deleted refresh token, the Authorization Server will reject this request because the refresh token is no longer available (we’ll come into this with more details).
The simple way is to issue short lived access tokens ,if you want to revoke the user , revoke the refresh token as the article shows , clear refresh token and access token on client side . Of cause , access token is still active until it expires .
Another way is to use Identity Server 4 Reference Tokens :
http://docs.identityserver.io/en/release/topics/reference_tokens.html
IdentityServer will store the contents of the token in a data store and will only issue a unique identifier for this token back to the client. The API receiving this reference must then open a back-channel communication to IdentityServer to validate the token
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
answered Nov 14 '18 at 6:46
Nan YuNan Yu
6,3602752
6,3602752
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53278004%2frevoke-reject-valid-json-web-token-in-asp-net-core-middleware-for-locked-out-use%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
