ADB2C Token Logout

Question

Hi

I have an adb2c tenant, and I have a system which uses adb2c login token to access apis.

Once the user is logged in, the apis validate the token using jwks uri provided by B2C.

The issue is, once the user logs out, the system calls the logout endpoint.

But this does not invalidate or cancel the login token received earlier.

Is there a way to cancel the login token as soon as the logout endpoint is triggered ?

What other ways are there where I can achieve this ?

Thanks,

Answer 1

Hello, you can revoke Azure AD B2C refresh tokens using MS Graph but not id or access tokens. You can, however, develop a custom token revocation solution. E.g. On logout click your application can store the desired token as revoked so that later it cannot no longer be used. If you want to extend such capability to other apps you can create a custom API that will expose both revoke and validate endpoints. Finally, you can integrate the former with other API's or even your user journey using API connectors.

For a more concrete solution let me know what type of applications and tokens you are dealing with.

Let us know if you need additional assistance. If the answer was helpful, please accept it so that others can find a solution.