Revocation
Revocation is the invalidation or withdrawal of a previously issued credential, key, certificate, token, or permission before or when its authorization ends.
Authorization in Action
Credential revocation is the invalidation of a credential before its expiration date.
- How it is used
- Shortens exposure windows by keeping authorization decisions aligned with changed identity, device, risk, employment, or delegation signals.
- How deep it goes
- Explains endpoints, signed lists, cached updates, and fallback workflows, but does not specify a single universal revocation protocol.
- Examples
- Uses revoked employment and certification credentials, signed status lists, real-time endpoints, supplier delegations, and event-driven signal updates.
- What you can do after
- Operate authorization checks that reject revoked credentials and provide limited, logged exception paths when status verification fails.
Real-World Cryptography
Certificate revocation is the process of declaring a previously issued certificate invalid before its scheduled expiration.
- How it is used
- Protects TLS connections by removing compromised certificates from otherwise trusted web public-key infrastructure.
- How deep it goes
- Compares CRLs, OCSP, and OCSP stapling, including operational drawbacks, but stops short of implementation details.
- Examples
- Uses web browsers, websites, mobile applications, CRLs, OCSP queries, and stapled responses as concrete examples.
- What you can do after
- Evaluate certificate-status mechanisms and recognize their availability, privacy, size, and user-experience tradeoffs.
Software Security for Developers
Token revocation is the invalidation of a security token before or at the end of its normal validity period.
- How it is used
- Explains how to undo trust after certificate compromise, loss of authorization, or refresh-token theft.
- How deep it goes
- Defines triggers, reporting, client checks, CRLs, and OCSP, but stops short of implementation procedures.
- Examples
- Uses a stolen private key, certificate revocation lists, OCSP, and refresh-token theft as concrete cases.
- What you can do after
- Evaluate when compromised certificates or refresh tokens require revocation and identify the responsible operational team.
Read how Software Security for Developers explains revocation →
Spring Security in Action, Second Edition
Token revocation is the process of invalidating a token before its normal expiration so that it can no longer be used.
- How it is used
- Protects OAuth 2 resources by invalidating stolen access tokens before expiration when extra protection is justified.
- How deep it goes
- Explains the endpoint workflow, default activation, introspection requirement, and performance trade-off without implementation internals.
- Examples
- Uses cURL requests against the revocation and introspection endpoints with HTTP Basic client authentication.
- What you can do after
- Operate token revocation and verify that introspection marks the revoked token inactive.
Read how Spring Security in Action, Second Edition explains revocation →
Related concepts
- token introspectionuses · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
- tokenuses · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
- defense in depthpart of · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
- introspection uriuses · An introspection URI is a network address identifying an endpoint that validates a token or credential and returns its validity or associated metadata.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.