How revoke a JWT in Web API C#?

Question

I have a web API in C # (no core) to which I integrated JWT, so there is no problem, now, I would like to know how to revoke a JWT that currently exists, delete it before it expires.

That is, my JWT lasts a total of 20 minutes, but when I close the session, in my APPS I delete that JWT so that they can no longer use it, but in the API, that JWT remains active until it expires for time, how can I delete or expire that JWT in my API?

Answer 1

So basically you want to make inactive just one Jwt token issued by your Api while rest of them are still active. You can't do this straightaway.

Most feasible solution would be to,

Have a smaller lifespan for the Jwt tokens. Then you have to implement refresh token logic as well. If already in place you are good. Now if you want to inactive the token for specific user you can remove the refresh token from the back end. Then the next time user try to refresh, it fails. But still he can access the system until the issued Jwt expires. So make it's lifespan small such as 1 or 2 minutes so that the impact is low.

Cheers,