search

Kuadrant / authorino

K8s-native AuthN/AuthZ service to protect your APIs.
Apache License 2.0
201 stars 32 forks source link

Access token revocation #19

Open guicassolato opened 3 years ago

guicassolato commented 3 years ago

Authorino should implement some support for access token revocation. Even with access tokens being checked in the identity verification step, Authorino could save processing and some external I/O by:

  1. providing an API to be informed about revoked access tokens, thus also ensuring support for immediate access suspension, and
  2. implementing a caching layer for revoked access tokens.
alechenninger commented 2 years ago

I wonder if a bloom filter could be used to see if a token might be revoked. That is, check if it "might" be revoked (in the set), and only then do the more expensive IO to introspect the token.