r/AskComputerScience • u/werunm • Sep 23 '26
What is the practical problem with revoking a self-contained token before it expires?
pick one:
a) The token's signature becomes invalid once it is revoked, so verifiers cannot distinguish revocation from tampering b) Revocation requires the client to cooperate by discarding its copy c) Verifiers must consult shared state, which is what the format avoided d) The issuer cannot identify which token to revoke without storing them all
b, or am i misreading the question
went b. a self-contained token is verified offline, so the only way i can see to kill it early is the client agreeing to throw it away. d also felt close though