Revoking tokens and sessions

Authentication and authorization Mid-level Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Predict the output

A token issued at 1000 is checked after the user's 'valid after' moved to 1500. What's printed?

Python 3.13
valid_after = {"user-7": 1500}


def accept(sub: str, issued_at: int) -> bool:
    return issued_at >= valid_after.get(sub, 0)


print(accept("user-7", 1000), accept("user-7", 1600))

Options
Hint 1 of 1

Compare iat with the cut-off.

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A False True

Correct. Tokens issued before the cut-off fail; new logins work.

A per-user 'valid after' time revokes every token issued before it in one write. The check compares each token's issued-at time with that cut-off, so 1000 fails and 1600 passes.

Why not the others?
  • B True True. The old token predates the cut-off.
  • C False False. Tokens issued after 1500 are fine.
  • D True False. Reversed.

30-second answer

Delete all their server-side sessions, revoke all refresh tokens (or their token families), and make outstanding access tokens fail. Short-lived JWTs will die soon on their own; to cut them off instantly, keep a per-user 'tokens valid after' timestamp or version that services check, or a deny list of token ids until they expire. Then require re-authentication and, if credentials may be exposed, a password reset and MFA re-enrolment.

Practise saying it · 30 s. No recording, just a timer

Revoke everything for a user.

Say your answer out loud, then check which of these points you covered:

  • Delete sessions
  • Revoke refresh families
  • Version or deny list for access tokens
  • Re-auth, reset
  • Audit

Deep dive

A deny list only needs entries until each token's own expiry.

Token introspection (RFC 7662) lets services ask the auth server, at a latency cost.

Notify the user and show active sessions with a 'sign out everywhere' option.

Audit what the stolen sessions did.

Common mistakes

  • Hour-long access tokens with no revocation path.
  • Deleting sessions but leaving refresh tokens valid.
  • A deny list kept forever.

Senior take & follow-ups

Sessions, refresh tokens, access tokens (version or deny list), then re-auth and audit.

Follow-up questions

Think of your answer first, then open the hint.

  1. How do services learn about revocation quickly?

    Show hint

    A cached per-user version or deny list, refreshed every few seconds.

  2. What does RFC 7662 define?

    Show hint

    OAuth token introspection.

Suggest a fix if something here is wrong or out of date.