How deeply does Spring Security in Action, Second Edition cover revocation?

Explains the endpoint workflow, default activation, introspection requirement, and performance trade-off without implementation internals.

Revocation

As explained in Spring Security in Action, Second Edition

Token revocation is the process of invalidating a token before its normal expiration so that it can no longer be used.

Token revocation invalidates an access token before its normal expiration, such as after discovering that a token was stolen. Spring Security authorization servers enable the revocation feature by default. section 14.5

Use the authorization server’s revocation endpoint to:

Submit the token to revoke with HTTP Basic authentication using the client credentials. section 14.5
Validate the result through introspection; a revoked token is reported inactive even when its time to live remains. section 14.5
Account for the performance cost: revocation requires introspection on every call, including when using non-opaque tokens. section 14.5

Revoke and verify a token

POST the token to /oauth2/revoke with client authentication, then POST it to /oauth2/introspect and confirm that it is no longer active.

How Spring Security in Action, Second Edition covers it

Cover of Spring Security in Action, Second Edition

liveBook manning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Authorization in ActionCredential revocation is the invalidation of a credential before its expiration date.
liveBook manning.com

Real-World CryptographyCertificate revocation is the process of declaring a previously issued certificate invalid before its scheduled expiration.
liveBook manning.com

Software Security for DevelopersToken revocation is the invalidation of a security token before or at the end of its normal validity period.

Compare how 4 books explain revocation →

Related concepts

token introspectionuses · Token introspection is an OAuth operation in which a service queries an authorization server about a token’s validity, status, and metadata.
tokenuses · A token is a discrete unit of text, such as a word, word fragment, character, or symbol, represented and processed as an element by a language model.
defense in depthpart of · Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
introspection uriuses · An introspection URI is a network address identifying an endpoint that validates a token or credential and returns its validity or associated metadata.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.