User is still logged in once oauthv2 token is revoked

[madhavikris]

Is there any way to invalidate oauthv t2oken immediately? when I read apigee documents I found that : OAuth tokens are cached for three minutes (180 seconds); therefore, a revoked token may still succeed for up to three minutes, until its cache limit expires.@dchiesa1 Please suggest

[dchiesa1]

There's no way to tell Apigee, in OAuthV2/VerifyAccessToken, to completely disable the cache of the OAuth 2 token. But, you can specify the TTL of the cache, using a new(-ish) configuration element  in the OAuthV2 policy. By reducing that cache TTL to as low as 1 second, you almost get the "disable the cache" behavior you imagined. And I guess that would be good enough.

The configuration looks like this: 

<OAuthV2 name='OAuthV2-Verify-Access-Token'>
  <Operation>VerifyAccessToken</Operation>
  <CacheExpiryInSeconds ref="propertyset.settings.token-ttl">40</CacheExpiryInSeconds>
</OAuthV2>

This works in X and hybrid.

You should take care when doing this with high-scale, high-throughput systems.  Reducing the cache TTL can make the system perform more slowly. That may be a good tradeoff in some cases. 

[AlexET · Accepted solution]

Hi @madhavikris, thank you for bringing this question to the community, and a big thanks to @dchiesa1  for the response!

If the reply provided resolved your issue, it would be great if you could mark it as an accepted solution to help others with similar questions. ✅

We’re glad to have you here—feel free to explore or join other conversations in the community anytime. 😉