ADR requirement (§Hashing → Tokens): Generated tokens must not be stored; if revocation is needed, store the token id (jti) or the signature — no hashing required.
Current state (NOT FOUND): No revocation store / denylist; no jti persistence. Opaque tokens are stateless-encrypted and cannot be individually revoked.
Tasks:
- Decide revocation model (store
jti or signature for revocable token types).
- Add a revocation store keyed by
jti/signature with expiry-based cleanup.
- Enforce revocation checks in the token verifier for applicable token types.
Acceptance: A revoked token id is rejected at verification; no full token or hashed token is stored.
ADR requirement (§Hashing → Tokens): Generated tokens must not be stored; if revocation is needed, store the token id (
jti) or the signature — no hashing required.Current state (NOT FOUND): No revocation store / denylist; no
jtipersistence. Opaque tokens are stateless-encrypted and cannot be individually revoked.Tasks:
jtior signature for revocable token types).jti/signature with expiry-based cleanup.Acceptance: A revoked token id is rejected at verification; no full token or hashed token is stored.