How to invalidate a OAuth2 token (Portal for ArcGIS)

Question

I am developing a REST API with .NET Core 6 using an OAuth 2 authentication. I need a login which does:

• authenticate the user using the REST API
• issue a (user-specific) token I can use in the web application (ArcGIS API for Javascript)

For this, I am using AspNet.Security.OAuth.ArcGIS and basically the Server-Enabled Workflow. Everything works fine until I sign out.

When I sign out, the cookie is removed and I have no access to REST API any more. So far so good but the access_token is not invalidated. I can still use the token to access ArcGIS web services.

I understand that there is no logout option available with AspNet.Security.OAuth.ArcGIS. So I was looking into alternative ways how to invalidate the token:

• /oauth/revokeToken: not working with this kind of token

How can I invalidate an access_token?

Some of the resources I used:

• ArcGIS Portal use server-side obtained authorization in the client / JavaScript
• https://community.esri.com/t5/arcgis-online-questions/revoking-oauth2-tokens/m-p/492688#M24868
• https://www.youtube.com/watch?v=PLr2Ii7iVEs

• KHibma: Have you posted to the Esri forums? You may grab the attention of a developer over there?
• Thomas: No I haven't yet. I don't really like using Esri's community forum. Their editor is horrific to use and I usually avoid their forum unless it's really important. However, since I don't get response here, I will consider it. Thanks for reminding me. I went with a workaround and I use a proxy endpoint to funnel all UI requests for the ArcGIS REST API. That way I don't have to expose a token.