When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an active flag. When I deactivate an account I set this flag to False which is checked on login, if False the user will not be able to login and will not receive an authentication token.

However, I have to cover the scenario where a mobile device could be misplaced while the user still has a valid token. So someone who should not see data now has access to it. I can deactivate the user account but with an existing valid token the user would still be able to use the app until it expires.

Is there a way to force token expiration for a certain user? Do I have to store the tokens in a database to be able to achieve this?


You cannot force token expiration. Tokens expire when its lifetime (determined when constructed) has passed.

You can distribute a blacklist to the points in your system where they are checked (eg api server for remote resource or the app for a local resource) to enable you to revoke them. If your token contains the userId you can distribute a blacklist of userIds and just check if it is on the blacklist. If your tokens do not contain some kind of identifier you have to store the tokens you issue for each user until they expire and distribute a blacklist of tokens.

You could also choose to give your tokens a very short livetime and just wait for them to expire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.