FAQ: Why Does the Introspection Endpoint Say Consent Has Been Revoked for a Valid Token?

Version Affected: All

 

Overview

The debug logs show "[IntrospectionHandler].[ValidateJwt]: Consent has been revoked" for a token even when that token has a valid, unexpired lifetime. Why does this happen?
 

Answer

This happens because acquiring a new access/refresh token pair invalidates the previous pair, regardless of whether the previous pair had expired. If you have a valid access token and refresh token (AT1 & RT1), and then acquire another pair (AT2 & RT2), an introspection call against AT1 or RT1 returns "active": false — even though neither had actually expired.

More specifically:

• If you have a valid access and refresh token pair (AT1 & RT1) and redeem RT1 to acquire a new pair (AT2 & RT2), both RT1 and RT2 remain valid, but AT1 is invalidated — only AT2 is valid.
• If you have a valid access and refresh token pair (AT1 & RT1) and acquire another pair (AT2 & RT2) without redeeming RT1, both AT1 and RT1 are invalidated. RT1 can still be redeemed once more to get a further pair (AT3 & RT3), but since that pair was acquired using an already-invalidated refresh token, introspection for both AT3 and RT3 will also return "active": false. In this scenario, only the tokens acquired by redeeming RT2 remain valid.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.