Webapi with oauth, revoke token?

Question

Hi everyone, I follow this article here to implement webapi with individual accounts using owin oauth.

Link

My question is, is there a way to deny access of tokens to webapi, the "exit" method really does nothing from me, since there is poor access to this webapi through the phone application. Thanks for any info!

Answer 1

It is difficult to cancel tokens - but you can limit their lifetime and periodically update them. take a look here: http://leastprivilege.com/2013/11/15/adding-refresh-tokens-to-a-web-api-v2-authorization-server/