Token Revocation
Invalidating an access or refresh token before it expires — straightforward for stateful tokens, genuinely hard for stateless JWTs, and the gap attackers exploit.
What is token revocation?
Token revocation invalidates an OAuth access or refresh token before its natural expiry — the mechanism behind “log out everywhere,” “this device was compromised, cut it off,” and “the user’s access was terminated.” How hard it is depends entirely on token design, and the difficulty is the whole story: stateful tokens are trivially revocable; stateless JWTs are notoriously not.
Why JWTs make this hard
A JWT’s selling point — self-contained, verifiable without a database lookup — is exactly what defeats revocation. Any service can validate a JWT’s signature and expiry locally, which means no central authority is consulted, which means there’s nowhere to say “this one is now invalid.” Revoke a JWT and it keeps working until it expires, because the services trusting it never ask permission. This is the same tension underlying Single Logout: distributed validation buys scale and costs revocability.
The patterns that actually work
The field has settled on a few approaches, each a compromise. Short-lived access tokens + revocable refresh tokens is the dominant answer: access tokens live 5–15 minutes (so the un-revocable window is small), while the long-lived refresh token — held and checked centrally at the authorization server — is revocable, so cutting it off stops new access tokens within minutes. Token introspection (services call the auth server to check validity per request) restores full revocability but sacrifices JWT’s stateless performance win — a deliberate trade for high-security contexts. Denylists (a shared cache of revoked token IDs every service checks) add revocation to JWTs at the cost of the lookup you were trying to avoid. And key rotation invalidates all tokens signed with a retired key — the blunt-instrument “revoke everything” for a breach.
What people get wrong
- Long-lived access JWTs with no revocation path — a stolen token stays valid for hours or days.
- Assuming logout revokes tokens — it clears the client’s copy; the token itself often remains valid server-side until expiry.
- No breach playbook: not knowing whether you can mass-revoke (key rotation, denylist) until you urgently need to.
Primary source: RFC 7009 — OAuth 2.0 Token Revocation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.