iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A password reset is not a reliable, universal way to end an attacker’s access. It may stop some forms of authentication, but refresh tokens, identity-provider cookies, and sessions issued by individual SaaS applications can follow different revocation rules. Respond to a suspected token theft by blocking new sign-ins where appropriate, revoking identity-provider tokens and sessions, terminating app-native sessions separately, and verifying that old credentials no longer work.
Why a password reset may not end an attacker’s session
A password, an OAuth token, and a SaaS session are different pieces of authentication material. Changing a password changes a credential; it does not, by itself, guarantee that every token or application session already issued has been invalidated.
OAuth access and refresh tokens are issued by an authorization server under that server’s policies. RFC 9700, the IETF’s January 2025 OAuth security Best Current Practice, says authorization servers may automatically revoke refresh tokens after a security event such as a password change or logout. It does not require every provider to use those events as a universal revocation trigger.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsMicrosoft Entra documentation illustrates why the provider and method matter: the outcome can differ by token type and by how a password was changed or reset. In particular, do not assume password changes affect password-based and non-password-based tokens identically.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
There is another boundary between the identity provider and the SaaS application. Microsoft says Entra cannot directly revoke a session token issued by an application. A browser cookie or server-side session may therefore remain usable until that application invalidates it or its own authorization policy ends it. This is an architectural distinction; the specific behavior varies by provider and application.
Which session material must be dealt with?
Identify both the credential and the system that enforces it. Revoking one kind of token does not necessarily terminate other kinds of access.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Material | What it does | Where to address it | Important qualification |
|---|---|---|---|
| Access token | Lets a client access a resource server within the token’s permissions and validity. | The issuer’s revocation mechanism and, where supported, the resource server’s enforcement. | RFC 7009 says implementations must support refresh-token revocation and should support access-token revocation. Do not assume all resource servers learn about revocation immediately. |
| Refresh token | Can be exchanged for new access tokens, potentially extending access beyond the life of an existing access token. | The authorization server or provider’s grant and token controls. | RFC 9700 permits automatic revocation after security events; provider policy determines whether it happens. A revocation may also affect related tokens or the underlying grant, depending on server policy. |
| Identity-provider browser cookie or sign-in session | Can maintain an authenticated session with the identity provider and support later sign-ins or token issuance. | The identity provider’s session-revocation controls. | For Microsoft Entra, Microsoft Graph’s revokeSignInSessions operation invalidates user refresh tokens and browser session cookies, but Microsoft documents a possible delay of a few minutes. |
| SaaS-native session | Maintains a login within an application, often using an application-issued cookie or server-side session. | The SaaS application’s session or user-access controls. | Identity-provider revocation alone may not invalidate it. Check browser, mobile, API, and other application sessions separately. |
Access-token lifetime also matters, but a short lifetime is not the same as immediate session termination. Microsoft’s Entra emergency guidance states that Entra access tokens last one hour by default; that is a Microsoft-specific default, not a universal OAuth lifetime. Microsoft also notes that browser applications commonly rely on application session tokens.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What to do after a suspected OAuth-token theft
Use your incident process and the controls available in the affected identity provider and SaaS applications. The steps below are an operational sequence, not a single cross-provider API recipe.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Contain new access and preserve evidence. If the account is compromised, use the identity provider’s account-disable or block-sign-in controls as appropriate. Before removing access, capture the affected accounts, applications, grants, devices, and relevant time window where feasible. Preserve evidence in approved locations without copying exposed tokens into tickets or other broadly accessible records.
- Revoke identity-provider refresh tokens and sign-in sessions. In Microsoft Entra, Microsoft documents blocking new sign-ins and revoking refresh tokens. Its Graph
revokeSignInSessionsoperation invalidates user refresh tokens and browser session cookies. Microsoft documents a possible delay of a few minutes before tokens are revoked; it also says the operation does not revoke sessions for external users authenticating through their home tenant. - Revoke OAuth tokens or grants at the issuer. RFC 7009 defines an HTTPS token-revocation endpoint and requires implementations to support refresh-token revocation. It recommends support for access-token revocation. Depending on the authorization server’s policy, revoking a token may also invalidate related tokens or its grant; confirm the provider’s actual behavior rather than assuming cascading revocation.
- Terminate sessions inside each affected SaaS application. Use the application’s own session-revocation or user-session termination controls, and revoke app-specific grants where available. Check whether browser, mobile, API, and integration credentials are managed separately.
- Rotate secrets if the incident exposed them. Rotate client secrets or signing keys if those were compromised. Remove tokens from logs, repositories, shell history, tickets, and exported incident artifacts where possible. Protect token-bearing stores and backups as sensitive data.
- Test the cutoff and record the result. Where safe, test whether an old refresh token and an already-open application session still work. Record which control ended each session, how long propagation took, and whether reconnecting required interactive authorization. RFC 7009 cautions that revocation can take time to reach all servers.
How to reduce the impact of the next token compromise
Limit what each token can do
Use the minimum scopes an application needs, and constrain an access token’s audience to its intended resource server or a small set of resource servers. If a token is exposed, narrower permissions and resource binding can limit its reach. Google’s OAuth guidance also recommends requesting scopes incrementally, when a user invokes the related functionality, rather than asking for every permission at initial sign-in.
Make refresh-token replay harder to exploit
RFC 9700 says refresh tokens issued to public clients must be sender-constrained or use rotation to detect replay. Rotation replaces a refresh token when it is used; reuse of an invalidated token can reveal replay and lead the server to revoke the active token. That response can require the legitimate user to authorize again. Sender constraint, including DPoP, binds token use to a key, but the protection is weakened if an attacker steals both the token and the key material.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect token storage and transit
Keep tokens out of plaintext logs and public repositories, transmit them only over protected channels, and use secure, platform-appropriate storage. Google advises server-side applications to encrypt tokens at rest and protect token datastores from public internet access. RFC 9700 likewise emphasizes protecting tokens in storage and transit.
Keep an accurate inventory of grants and clients
Track each OAuth client’s owner, purpose, permission set, and review date. Google recommends auditing OAuth clients and proactively removing obsolete ones rather than relying on automatic deletion. An inventory helps responders identify which applications need grant revocation and which owners must terminate app-native sessions.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Design for unexpected invalidation
RFC 7009 says clients must be prepared for unexpected token invalidation. Applications should handle failed refreshes through a clear reauthentication flow, make revocation observable to operators, and distinguish an invalidated credential from an unexplained service outage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to verify in your environment
An identity provider reporting that a revocation request succeeded does not establish that every SaaS session has ended. For each critical application, document and periodically test:
- Which controls revoke one token, a grant, user-wide refresh tokens, identity-provider sessions, or all application sessions.
- Whether the application checks revocation immediately or continues to accept already-issued tokens until another event or expiry.
- How long changes take to reach replicas and resource servers.
- Whether browser, mobile, API, and service-integration sessions use separate credentials or termination controls.
- Whether a user must complete interactive authorization after revocation, and how the application handles that interruption.
Standards define protocol behavior, while providers and SaaS applications determine many operational details. Treat the identity provider, resource server, and application as separate enforcement points until testing confirms otherwise.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
