I've set up the authentication for Web API which is almost identical to this blog here oauth-refresh-tokens from Taiseer Joudeh.
It worked perfectly until I met an issue:
- We have User A and User B are currently logged in to the system.
- User A as administrator, removes user B from the system.
- User B still has permission to access the web until the token is expired.
I've done some research and they all said that revoking an access token is quite difficult (or not possible in OAuth). The only thing I could do is to set the timeout shorter. It's still glitching in my mind and I do not like the idea that access token is still valid to (although a limited) frame of time after.
So, is there any better approach or any advice would be much appreciated.