Interface ITokenDenylist

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

Server-side revocation list for portal JWTs, keyed by the token's jti claim. Logout records the surrendered token here; the bearer middleware rejects denylisted tokens on every authenticated request. Entries live only until the token would have expired anyway, so the list stays small.

public interface ITokenDenylist

Methods

DenyAsync(string, DateTimeOffset, CancellationToken)

Records a token's jti until the token's own expiry (plus clock skew) passes. Never throws: a failed write degrades revocation, not logout.

Task DenyAsync(string jti, DateTimeOffset tokenExpiresAt, CancellationToken cancellationToken = default)

Parameters

jti string

tokenExpiresAt DateTimeOffset

cancellationToken CancellationToken

Returns

Task

IsDeniedAsync(string, CancellationToken)

Whether a jti has been revoked. Fails open (returns false) when the backing store is unreachable so a cache outage never locks out the portal.

Task<bool> IsDeniedAsync(string jti, CancellationToken cancellationToken = default)

Parameters

jti string

cancellationToken CancellationToken

Returns

Task<bool>