When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an active flag. When I deactivate an account I set this flag to False which is checked on login, if False the user will not be able to login and will not receive an authentication token.
However, I have to cover the scenario where a mobile device could be misplaced while the user still has a valid token. So someone who should not see data now has access to it. I can deactivate the user account but with an existing valid token the user would still be able to use the app until it expires.
Is there a way to force token expiration for a certain user? Do I have to store the tokens in a database to be able to achieve this?