title: Revoke access token of OAuthBearerAuthentication
body: <p>I've set up the authentication for Web API which is almost identical to this blog here <a href="http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/" rel="nofollow">oauth-refresh-tokens</a> from Taiseer Joudeh.</p>
  
  <p>It worked perfectly until I met an issue:</p>
  
  <ul>
  <li>We have User A and User B are currently logged in to the system.</li>
  <li>User A as administrator, removes user B from the system.</li>
  <li>User B still has permission to access the web <strong>until</strong> the <strong>token</strong> is <strong>expired</strong>.</li>
  </ul>
  
  <p>I've done some research and they all said that revoking an access token is quite difficult (or not possible in OAuth). The only thing I could do is to set the timeout shorter. It's still glitching in my mind and I do not like the idea that access token is still valid to (although a limited) frame of time after. </p>
  
  <p>So, is there any better approach or any advice would be much appreciated.</p>