如何使用 Identity Server 4 撤销或使令牌无效？

Question

I read this docs: http://docs.identityserver.io/en/release/endpoints/revocation.html

Then I try this code:

AuthHelper.cs

public class AuthHelper
{
    private string URL = "http://localhost:50847/connect/revocation";


    public bool revocarToken(string token)
    {
        try
        {
            HttpClient client = new HttpClient();
            string uri = URL;
            StringContent contenido = new StringContent("token="+token+"&token_type_hint=access_token", System.Text.Encoding.UTF8, "application/x-www-form-urlencoded");
            HttpResponseMessage response = client.PostAsync(uri, contenido).Result;

            if (response.IsSuccessStatusCode)
                return true;
            return false;
        }
        catch (Exception ex)
        {
            throw;
        }
    }
}

But, I get this error:

I get an error 400 (Bad request). Thanks in advance.

Answer 1

You're not sending the required credentials to revocation end point. IdentityServer expects you to provide a client id and secret. Please read https://tools.ietf.org/html/rfc7009#section-2.1 specification to understand better.

I recommend you to use IdentityModel2 package to make the revocation request (and other OIDC related requests).