如何手动/强制使自研ASP.NET Web API生成的Access-Token失效

Great question—token theft is a critical vulnerability when storing tokens in browser storage (localStorage/sessionStorage), since malicious actors can siphon them via XSS attacks or tools like Fiddler/Postman. Let’s cover both prevention tactics and actionable ways to invalidate tokens manually.

Prevention Strategies to Mitigate Token Theft #

First, let’s reduce the risk of tokens being stolen in the first place:

• Shorten Access Token Lifespans
  Use short-lived Access Tokens (e.g., 15–30 minutes) paired with longer-lived Refresh Tokens. If an Access Token is stolen, its window of misuse is limited. Store Refresh Tokens in HttpOnly, Secure, SameSite cookies (not browser storage) so they’re inaccessible to client-side JavaScript, blocking XSS theft.

• Avoid Browser Storage for Sensitive Tokens
  localStorage/sessionStorage are vulnerable to XSS. Instead, use HttpOnly cookies for tokens:

  • HttpOnly: Prevents JavaScript from reading the cookie, stopping XSS attacks.
  • Secure: Ensures the cookie is only sent over HTTPS.
  • SameSite=Strict/Lax: Mitigates CSRF attacks by restricting cookie transmission to same-site requests.

• Bind Tokens to User Context
  Embed a unique identifier (like a hashed device fingerprint from User-Agent or a session ID) in the token’s claims. When validating the token, check that this identifier matches the current request’s context. Mismatches can indicate a stolen token.

• Enforce HTTPS Everywhere
  Mandate HTTPS for all API requests to prevent man-in-the-middle attacks from intercepting tokens in transit. Add an HSTS header to enforce browsers only connect via HTTPS.

• Implement XSS and CSP Protections
  Use strict Content Security Policies (CSP) to block unauthorized script execution, and sanitize all user input/output to reduce XSS attack surfaces.

How to Manually/Force Invalidate Tokens #

Even with prevention, you’ll need to invalidate tokens on demand (e.g., user logs out, account is compromised, or permissions change). Here are reliable methods for ASP.NET Web API:

1. Token Blacklist (Revocation List) #

Maintain a fast, in-memory store (like Redis) to track revoked tokens. For JWTs, store the token’s unique ID (jti claim) in the blacklist with an expiry matching the original token’s lifespan (to avoid infinite storage growth).

Example Implementation:

// Token validation middleware check
public async Task ValidateTokenAsync(string token)
{
    var jwtHandler = new JwtSecurityTokenHandler();
    var jwtToken = jwtHandler.ReadJwtToken(token);
    var jti = jwtToken.Claims.First(c => c.Type == JwtRegisteredClaimNames.Jti).Value;

    // Check if token is revoked
    var isRevoked = await _redisCache.GetStringAsync($"revoked:{jti}");
    if (!string.IsNullOrEmpty(isRevoked))
    {
        throw new SecurityTokenException("Token has been revoked");
    }

    // Proceed with standard token validation...
}

// Method to manually revoke a token
public async Task RevokeTokenAsync(string jti, DateTime tokenExpiry)
{
    var remainingValidity = tokenExpiry - DateTime.UtcNow;
    await _redisCache.SetStringAsync(
        $"revoked:{jti}", 
        "true", 
        new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = remainingValidity }
    );
}

2. Tie Tokens to User Credential Changes #

Add a LastPasswordChanged or LastSecurityUpdate timestamp to your user database. When validating a token, compare its issued time (iat claim) to this timestamp. If the token was issued before the last credential change, reject it.

Example Check:

var user = await _userManager.FindByIdAsync(userIdFromTokenClaims);
if (user.LastPasswordChanged > jwtToken.IssuedAt)
{
    throw new SecurityTokenException("Token invalidated due to account security update");
}

3. Invalidate Refresh Tokens #

If using Refresh Tokens, add them to the same blacklist when revoking access. Additionally, implement one-time-use Refresh Tokens: every time a user refreshes their Access Token, generate a new Refresh Token and invalidate the old one. This limits misuse if a Refresh Token is stolen.

4. Rotate Signing Keys (Global Invalidation) #

If you need to invalidate all tokens at once (e.g., signing key compromise), rotate your JWT signing key. All existing tokens will fail validation, forcing users to re-authenticate. Store keys securely (like in Azure Key Vault) for easy rotation.

Combining these prevention and revocation strategies will give you robust control over token security. The key is balancing security with user experience—short-lived tokens enhance security but require smooth refresh flows, while blacklists add minimal overhead for on-demand invalidation.

内容的提问来源于stack exchange，提问作者Umer Zaman