Design session revocation around a measurable latency

Session revocation is a latency requirement, not a boolean feature. Define how long access may continue after logout, password change, account suspension, and suspected theft. Then choose token and cache behavior that can meet each objective during partial failure.

Give each event a deadline

Logout usually expresses user intent on one device. A practical target may allow a brief propagation delay. Account suspension and credential compromise deserve a much tighter objective. Write the requirement as an observable bound: “Within 30 seconds of suspension, 99.9 percent of protected requests using existing sessions are rejected, including when one cache node is unavailable.”

The OAuth token revocation standard defines a revocation endpoint and notes that propagation delays can exist even when invalidation is intended to be immediate. It also contrasts self-contained tokens with handles that require authorization-server lookup and explains how short-lived access tokens bound the period of use after revocation.

Choose the validation path deliberately

Opaque tokens checked through introspection make current state available at request time. RFC 7662 defines token introspection and an active indicator that tells a protected resource whether a token is currently usable. The cost is a network dependency on the authorization service unless results are cached.

Self-contained access tokens allow local validation and tolerate an authorization-service outage, but a correctly signed token remains usable until expiry unless the resource server receives another signal. Keep access-token lifetimes short enough to satisfy the ordinary revocation objective, and protect refresh tokens so revoked grants cannot mint replacements.

A deny list can close the gap for high-risk events. Index it by a session or grant identifier, not only a single token string, so rotation does not bypass revocation. Expire entries when no related token can remain valid.

Revocation events can proactively evict gateway and service caches. Include session identifier, subject, tenant, event version, reason class, and effective time. Consumers must be idempotent and recover after disconnection by replaying from a durable offset or rebuilding state.

Bound every cache

A five-minute positive introspection cache creates a five-minute revocation window. Negative caching can also hurt recovery after an accidental suspension. Document separate TTLs for active and inactive results, and include the authorization epoch or session version in the cache key.

Avoid layered surprises. A gateway may reject a token promptly while a downstream service continues accepting a cached identity context. Inventory every place that turns credentials into identity: CDN, gateway, sidecar, application, WebSocket server, background worker, and download service.

Long-lived streams need an explicit rule. Reauthorize on a timer and on revocation events, then close the connection with a reason the client can handle. A WebSocket authenticated only during its initial upgrade can outlive every HTTP token policy.

Define outage behavior

For low-risk reads, a service may accept a recently cached active result during a short introspection outage. For administrative writes, failing closed may be appropriate. Make this choice per endpoint and cap stale use. Do not let a generic retry library turn denial into availability indefinitely.

Revocation itself should be idempotent. A user pressing logout twice should receive the same safe outcome. If the revocation service returns an unavailable response, the client must treat the token as potentially active and retry according to policy.

Test the real propagation path

Run a test that creates a session, warms every cache, opens a streaming connection, starts a background request, triggers suspension, and probes all paths until denial. Record the longest observed delay and the component responsible. Repeat with one event consumer disconnected and with introspection unavailable.

Pick the strictest business event today, assign its revocation objective, and draw the complete credential-to-service path. Any cache or connection without a bounded invalidation rule is the next engineering task.