All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? How does ASP.NET Core support multiple authentication schemes simultaneously (e.g., cookies for a web UI and JWT for an API in the same application)? How do you integrate external identity providers (Google, Microsoft Entra ID, Facebook) using OAuth/OpenID Connect in ASP.NET Core? How does token validation work under the hood when the JwtBearer middleware receives a request, and what checks does it perform? How do authentication and authorization work together in a .NET application, and how would you implement both role-based and policy-based access control?
Advertisement
.NET › Authentication & Authorization (Identity, JWT, OAuth)

How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued?

Advanced

Answer

Since JWTs are self-contained and valid until expiration regardless of server-side state, true revocation requires either: keeping token expiration very short combined with refresh token revocation (revoke the refresh token so no new access tokens can be issued, while the current one simply expires soon), or maintaining a server-side denylist/blocklist of revoked token IDs (jti claim) checked on every request -- which reintroduces some statefulness, trading off JWT's original stateless benefit for revocation capability.
// Denylist approach: check jti against a fast cache (e.g., Redis) on each request
var jti = User.FindFirst(JwtRegisteredClaimNames.Jti)?.Value;
if (await _revokedTokenCache.ExistsAsync(jti)) {
    return Results.Unauthorized();
}
Real-world example A security incident forces immediate logout of a compromised account; the team adds the affected user's active token jti values to a Redis-backed denylist checked by a custom authorization handler on every request until those tokens naturally expire.

Common follow-ups: What's the performance cost of checking a denylist on every request?;How do short-lived tokens plus refresh revocation compare to a full denylist approach?

Caching (In-Memory Distributed & Redis);Authentication & Authorization (Identity JWT OAuth)
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions