Having Trouble on Remove Auth0 Session When Logout From Front End

[JayKiller]

Perhaps I’m missing something with my understanding of how this all works, so please bare with me

we have both front end and back end app for authenticate our user account. The front-end app can login and logout without any issue and it works perfectly. When I logout the user from my front-end app, the access_token is still validated (and it never destroy on Auth0) . I can still use that access_token to make a request to my back-end/api because the expiration date is not yet passed. I had been reading so many articles about how to deal with it. Is there a better way to revoke the access_token from auth0 or any control that I can do for it? I need my users to be login to their computer or device without logout within 3 days. Do not suggest me to change the session in 3 mins like that. I need a better way to keep user login, and when they logout out. My back-end can know that the access_token is invalided.

Thank you any helpful tips

[dan.woda]

Hi @JayKiller,

What type of framework are you working with? You should be logging out in your front end by deleting the token and ending the session with the server via the /logout endpoint.

Let me know,
Dan

[dan.woda]

From an email:

@JayKiller

I want to destroy the jwt-token, I know how to end session with /v2/logout, but the thing is that the issue jwt-token was still available to my api to make a request.

Access Tokens cannot be revoked, by design.

Revoke Tokens

I would like to talk about your implementation because it sounds like there is a problem with them persisting after logout. Logout means a series of things, it can mean deleting a token, it can mean ending a session with the auth server, or removing a cookie. In addition to ending the session (via the /logout endpoint) you must delete the token and thus “logout”.

Thanks,
Dan