title: Where is the information about the authorization token stored on the ASP.NET WEB API server?
body: <p>In my Web Api 2 Identity 2 application after user registration I have a single record in single table: AspNetUsers. I use the following http request to get token:</p>
  
  <pre><code>POST https://localhost:44304/Token HTTP/1.1
  Accept: application/json
  Content-type: application/x-www-form-urlencoded
  Accept-Encoding: gzip
  Content-Length: 68
  Host: localhost:44304
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)
  
  grant_type=password&amp;username=somemail@gmail.com&amp;password=123456
  </code></pre>
  
  <p>and I get the response with access_token:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: no-cache
  Pragma: no-cache
  Content-Length: 695
  Content-Type: application/json;charset=UTF-8
  Expires: -1
  Server: Microsoft-IIS/8.0
  X-SourceFiles: =?UTF-8?B?QzpcVXNlcnNcU2VyZ2V5XERvY3VtZW50c1xWaXN1YWwgU3R1ZGlvIDIwMTNcUHJvamVjdHNcbXZjX3dlYmFwaVxXZWJBcHBsaWNhdGlvblxXZWJBcHBsaWNhdGlvblxUb2tlbg==?=
  X-Powered-By: ASP.NET
  Date: Tue, 25 Nov 2014 17:40:07 GMT
  
  {"access_token":"gsvW23e1...}
  </code></pre>
  
  <p>After I have got the token no one record is added to the database. Still there is just single record in the table AspNetUsers. No information about the issued token is stored in any table in the database.</p>
  
  <p>I use the following code in web api controller to authenticate user:</p>
  
  <pre><code>var currentUser = manager.FindById(User.Identity.GetUserId());
  if (currentUser == null)
  {
      HttpResponseMessage response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
      return ResponseMessage(response);
  }
  </code></pre>
  
  <p>After that I perform password change and trying to call some web api controller method using the old access_token (which I got before password change) and the access_token is still valid! The currentUser is not null!
  I have read another threads on stackoverflow 
      <a href="https://stackoverflow.com/questions/21218027/asp-net-identity-sign-out-all-sessions">ASP.Net Identity sign-out all sessions</a>
      <a href="https://stackoverflow.com/questions/20681726/asp-net-identity-logout">ASP.Net Identity Logout</a>
  and blogpost
      <a href="https://timmlotter.com/blog/asp-net-identity-invalidate-all-sessions-on-securitystamp-update/" rel="nofollow noreferrer">https://timmlotter.com/blog/asp-net-identity-invalidate-all-sessions-on-securitystamp-update/</a>
  but I still don't understand where the information about the issued tokens is stored.
  So my questions are:
  1) Where is the information about the access_token stored on the server?
  2) Why after password change I can still use the access_token which is issued by the server before the password change?
  3) How to invalidate all the access_token issued before password change?</p>