阻止用户并手动使访问令牌过期后结束会话

Question

I'm running an ASP web API application with Angular 5 front end application, I'm using ASP Identity for Authentication.

Now my app has a feature of blocking users , but as I'm using access tokens, I can't find a way to log users out as soon as they are blocked unless I use a bad practice (mentioned in the last lines of the question).

There is a Verify method in the back end API application, it checks the access token if it is valid on each service call from the Angular app , of course this access token is not changed when the user is blocked, so the user keeps accessing until his access token expires.

what is the best practice to overcome this?

the bad practice I'm using:

  Verify() {
     var db = new ApplicationDbContext();
     var user = db.users.Where(a => a.UserName == User.Identity.Name).FirstOrDefault();

     if(!user.isActive) { return Ok("Blocked")}
     else {
        if (User.Identity.IsAuthenticated) { return Ok("Authorized"); }
        else return Ok("Not Authorized");
        }
  }

but the function Verify is called many times, so searching the database each time is not a good solution.

--> To clarify the signing out in the Angular app, it first clears the access token from local storage, then redirects to sign in page, so it has nothing to do with the Web Api

--> Please tell me if any point needs to be clarified in my question

Answer 1

If avoiding db calls is absolutely necessary I would push the responsibility of booting the user from the application to the Angular side. Please see my proposed flow using web sockets below.

1. The admin blocks the user , the api gets hit with block instruction for a user. The api marks the user as blocked in the database and pushes a message down to the angular application via websockets (I would use signal R for your setup) that contains the userId.
2. The angular application checks if the userId sent from the api is the one that belongs to the current users session (session storage perhaps). If that is the case boot the user out by clearing hes token and signing him out.
3. If the user tries to log in again simply move the check to see if a user is blocked to your login method and he/she will no longer be able to log in again.

This is putting all your eggs in one basket by relying on your socket connection to boot users but it cancels out having the responsibility on the api to check on every call and will reduce the chatter to your db.