Revocation

As explained in Software Security for Developers

Token revocation is the invalidation of a security token before or at the end of its normal validity period.

Revocation invalidates a security token before, or at the end of, its normal validity period. For certificates, it matters when a private key is exposed or the holder should no longer have access: the certificate authority marks the certificate as untrusted so clients stop accepting it. section 9.1.5 section 9.3

A practical revocation flow includes these responsibilities and checks:

• Report the compromised or unwanted certificate to its certificate authority. section 9.1.5
• Record the certificate on a certificate revocation list so relying clients can identify it. section 9.1.5
• Check revocation during certificate validation before deciding whether to trust the certificate; CRLs and OCSP provide the stated mechanisms. section 9.1.5 section 8.3
• Treat certificate revocation as an operational task usually handled by DevOps specialists or platform engineers, while developers understand its purpose. section 9.1.5

A stolen private key

A private key is accidentally published online before its certificate expires. The owner asks the CA to revoke the certificate; the CA adds it to a revocation list, and clients check that status before trusting it. The same security concern appears with refresh tokens: prompt revocation is one mechanism for limiting misuse after a token is lost or stolen. section 9.1.5 section 13.2

Figure 9.1 The certificate life cycle. This figure walks you through the four main steps of getting a valid digital certificate: generating a key pair, creating a CSR, having it validated by a CA, and receiving the issued certificate.

Use the certificate life-cycle diagram to place revocation after issuance and alongside certificate expiry. section 9.1

How Software Security for Developers covers it

How deep it goes

Defines triggers, reporting, client checks, CRLs, and OCSP, but stops short of implementation procedures.

Examples

Uses a stolen private key, certificate revocation lists, OCSP, and refresh-token theft as concrete cases.

What it assumes

Assumes basic awareness of certificates, private keys, certificate authorities, and token lifetimes while teaching revocation from practical scenarios.

What you can do after

Evaluate when compromised certificates or refresh tokens require revocation and identify the responsible operational team.

How it connects

Connects revocation with X.509 certificates, certificate authorities, certificate validation, CRLs, OCSP, OAuth 2.0, and OpenID Connect.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionCredential revocation is the invalidation of a credential before its expiration date.
• 

  liveBookmanning.com
  Real-World CryptographyCertificate revocation is the process of declaring a previously issued certificate invalid before its scheduled expiration.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionToken revocation is the process of invalidating a token before its normal expiration so that it can no longer be used.

Compare how 4 books explain revocation →

Related concepts

• token introspectionuses · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
• tokenuses · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
• defense in depthpart of · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
• introspection uriuses · An introspection URI is a network address identifying an endpoint that validates a token or credential and returns its validity or associated metadata.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.