JaskaranK.57666 (Customer) asked a question.
/revoke API not working as intended
I am using React + .net core and single page app okta option, i am trying to call revoke on logout so that the access token cannot be used afterwards to call any API's.
Okay on calling /revoke API, it gives me a 200 status first step done.
On calling /introspect it gives me active false which is also correct.
But when i try to authenticate my API using the same access token it works fine. why is happening like that? The Access token is not expiring even on calling /revoke API
Once the access token is generated then it expires according to its initial determined life span only.
Okta will not accept the revoked token however if non-okta apis are being called using revoked token as bearer then it depends on the logic of downstreams. If the logic is to just extract the expiry time and signature validation which will certainly pass. It should have a mechanism to check with Okta if the token is revoked or not (it will add latency as overhead but security will be plus).
Hope this helps.