Class TokenDenylist

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

Server-side revocation list for portal JWTs, keyed by the token's jti claim. Logout records the surrendered token here; the bearer middleware rejects denylisted tokens on every authenticated request. Entries live only until the token would have expired anyway, so the list stays small.

public sealed class TokenDenylist : ITokenDenylist

Inheritance

object

TokenDenylist

Implements

ITokenDenylist

Constructors

TokenDenylist(IDistributedCache, TimeProvider, ILogger<TokenDenylist>, IOptions<JwtSettings>)

Server-side revocation list for portal JWTs, keyed by the token's jti claim. Logout records the surrendered token here; the bearer middleware rejects denylisted tokens on every authenticated request. Entries live only until the token would have expired anyway, so the list stays small.

public TokenDenylist(IDistributedCache cache, TimeProvider timeProvider, ILogger<TokenDenylist> logger, IOptions<JwtSettings> jwtSettingsOptions)

Parameters

cache IDistributedCache

timeProvider TimeProvider

logger ILogger<TokenDenylist>

jwtSettingsOptions IOptions<JwtSettings>

Methods

DenyAsync(string, DateTimeOffset, CancellationToken)

Records a token's jti until the token's own expiry (plus clock skew) passes. Never throws: a failed write degrades revocation, not logout.

public Task DenyAsync(string jti, DateTimeOffset tokenExpiresAt, CancellationToken cancellationToken = default)

Parameters

jti string

tokenExpiresAt DateTimeOffset

cancellationToken CancellationToken

Returns

Task

IsDeniedAsync(string, CancellationToken)

Whether a jti has been revoked. Fails open (returns false) when the backing store is unreachable so a cache outage never locks out the portal.

public Task<bool> IsDeniedAsync(string jti, CancellationToken cancellationToken = default)

Parameters

jti string

cancellationToken CancellationToken

Returns

Task<bool>