Token revocation when server side sessions are enabled

[josephdecock]

We use extensibility points in the cookie handler to do two things when sessions end:

• delete the server side session (via our ITicketStore implementation) and
• revoke refresh tokens (via our PostConfigureApplicationCookieRevokeRefreshToken configuration)

These two features don't work together, because the cookie handler orchestrates them in the wrong order: it destroys the session (and the token with it) before it attempts to revoke the token, so revocation never occurs.

Need to investigate the best way to solve this.
Ideas:

• Revoke refresh tokens from within the ticket or user session store
• Revoke refresh tokens in the bff/logout endpoint
• Consider if the SessionRevocationService (used on backchannel logout) can help.

[Erwinvandervalk]

I'm not able to reproduce this issue so closing it for now.

[brockallen]

Is this similar to the expired cookie issue that @bhazen just worked on in IS?

[bhazen]

Is this similar to the expired cookie issue that @bhazen just worked on in IS?

It does similar. @Erwinvandervalk if you'd like me to walk you through the issue to which Brock is referring at some point so we can see if they are similar let me know.