Sessions
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
What Session revocation means
Revocation means a session stops working now. Many systems implement something weaker — the session is marked revoked, and the already-issued token keeps working until it expires, which may be fifteen minutes or an hour. When someone asks for an employee's access to be removed, that gap is the whole question.
How it works
The difficulty is self-contained tokens. A JWT access token is validated locally by signature, so the resource server never asks anyone whether it is still valid. That is the performance benefit and it is exactly why revocation cannot reach it.
Three approaches exist. Short lifetimes shrink the window without closing it. A revocation list or introspection call makes each check authoritative at the cost of a lookup. A session check at a defined point — on refresh, or on each validation against a session store — takes effect at the next check rather than at expiry.
Whichever is chosen, the honest thing is to publish which one. 'Revocation is immediate' and 'revocation takes effect at the next check of the session' describe different systems, and a security reviewer is entitled to know which they are looking at.
The mistake people actually make
Deleting the session record and assuming access has ended, while an access token issued a minute earlier remains valid for its full lifetime at every resource server that validates locally.
In Authreads
How this applies here
Revocation takes effect at the next check of a session rather than waiting for natural expiry, and per-tenant session policy covers idle timeout and absolute expiry.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Guides that go deeper
- Refresh token rotation and reuse detection, explained
- JWT vs opaque access tokens: which should you use?
- Logout in OpenID Connect: RP-initiated, front-channel and back-channel
- SCIM provisioning explained: automating user lifecycle for B2B
- B2B login flows: invitations, domains, SSO and the first admin
- Session management best practices for web applications
Related terms
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
Idle timeout and absolute expiry
Two different session limits: one measured from last activity, one from sign-in.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.