Allen Wu
2020-12-01 14:49:32
Move comments to answers for more people's reference.
Firstly, you are using access token to access the user profile. Access token cannot be revoked. But you could revoke the refresh token, then user will lose access to AAD when the old access token expires. The default expiration is 1 hour.
See reference here.
So you cannot restrict the Get User with the old token immediately, after you took the above steps:
For applications using access tokens, the user loses access when the access token expires.
热门帖子
热门github
6