代码中作废引用令牌（非调用/connect/revocation端点）：直接操作DB是否可行？

Great question! Let's break this down clearly into two parts: whether directly modifying the database via EF Core is a valid approach, and what other APIs you can use besides the /connect/revocation endpoint.

Yes, it's technically feasible—but there are critical caveats to keep in mind before you go this route:

• Understand the table structure: Reference tokens (and refresh tokens) are stored in the PersistedGrants table by default. You can target all tokens for a user by filtering on the SubjectId column. Just double-check you're deleting the right records (you might want to narrow it down by ClientId or Type if you only need to revoke tokens for specific clients, but your use case likely calls for deleting all for the subject).
• Don't ignore caching: If Identity Server uses caching for persisted grants (a common performance optimization), deleting records directly from the database won't clear the cache immediately. This means old tokens might still be accepted until the cache expires. To fix this, you'll need to manually clear the associated cache or rely on the framework's built-in services instead.
• Use transactions: Wrap your delete operation in a database transaction to ensure atomicity—especially if you're updating the user's password and revoking tokens in the same workflow.

That said, directly modifying the database bypasses Identity Server's internal logic, so it's not the most framework-compliant approach. It should be a last resort, not your first choice.

The safest and most maintainable options are to use Identity Server's built-in services, which handle edge cases like cache cleanup automatically:

1. IPersistedGrantService #

This is the official, purpose-built service for managing persisted grants (including reference tokens, refresh tokens, authorization codes, etc.). Inject it into your code and use the RemoveAllAsync method to bulk-revoke all tokens for a user:

private readonly IPersistedGrantService _persistedGrantService;

public YourUserService(IPersistedGrantService persistedGrantService)
{
    _persistedGrantService = persistedGrantService;
}

public async Task RevokeAllUserTokens(string subjectId)
{
    // Revoke all tokens for the user across all clients
    await _persistedGrantService.RemoveAllAsync(
        subjectId: subjectId,
        clientId: null,
        type: null,
        creationTime: null
    );
}

This method handles both database updates and cache invalidation, making it the most reliable choice.

2. Admin UI/Management APIs #

If you're using an official management tool like Duende Identity Server Admin (or IdentityServer4.Admin for older versions), these tools expose REST APIs and a web UI to bulk-revoke tokens for a user. Under the hood, they use IPersistedGrantService, so they're just a convenient wrapper for the same logic.

3. IRevocationService #

While this service is designed for revoking individual tokens (the same one used by the /connect/revocation endpoint), you could technically iterate over all a user's grants and revoke them one by one. However, this is far less efficient than using IPersistedGrantService's bulk method, so it's not recommended for your use case.

Prioritize using IPersistedGrantService whenever possible—it's built exactly for this scenario, avoids potential pitfalls with direct database access, and integrates seamlessly with Identity Server's internal workflows. Direct EF Core access should only be considered if you can't use the built-in services for some edge-case reason.

内容的提问来源于stack exchange，提问作者Ivar