Making Somebody Stop Being Signed In
Last timeRequests You Did Not Make
Access lives in more places than anybody remembers. This lesson inventories them, orders the revocation, verifies it landed, and names the window during which it has not.
Everywhere access lives
Somebody is dismissed at four in the afternoon and their access must stop.
This is the test of everything in the course, and it is failed far more
often by incomplete inventory than by missing mechanism.
Write the list out. Not the list of systems, the list of places where a
decision about this person is currently held.
| you can delete it direct | revocation lands immedia | it expires on its own cl | usually on the first dra | |
|---|---|---|---|---|
| browser sessions in your | 1 | 1 | 0 | 1 |
| access tokens already is | 0 | 0 | 1 | 1 |
| refresh tokens | 1 | 1 | 0 | 1 |
| third-party grants you i | 1 | 1 | 0 | 1 |
| long-lived keys for scri | 1 | 1 | 0 | 1 |
| cached permission lookup | 0 | 0 | 1 | 0 |
| a grant held at an exter | 0 | 1 | 0 | 0 |
| a signed cookie in a par | 0 | 0 | 1 | 0 |
Three entries deserve specific attention because they are routinely
forgotten. Long-lived keys issued for scripts and integrations, which
belong to a person who has now left and which no session logic touches.
Cached authorisation decisions inside services, which are correct and stale
for as long as their own lifetime. And grants at external providers, where
the person signed in to a third-party tool with your account and that tool
holds a refresh token you have no record of.
The order to do it in
The sequence matters, and getting it wrong is how a careful operator ends
up with a system that reissues what they just deleted.
The lesson stops here
5 more paragraphs to go
You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.
The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.
See the planThe contentsThis is the reading half
Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.
The contents