title: How to sign authenticated user out in Oauth 2.0 token based?
body: <p>I am using <strong>oauth 2.0</strong> with <strong>Identity</strong> framework in a web api application.</p>
  
  <p>In my web api I implemented authentication using Token-based authentication and refresh token.
  I need to sign the user out when his password changes(Here the security stamp will be changed).</p>
  
  <p>I have this code:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions {
  AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
  LoginPath = new PathString("/Account/Login"),
  Provider = new CookieAuthenticationProvider {
      // Enables the application to validate the security stamp when the user logs in.
      // This is a security feature which is used when you change a password or add an external login to your account.  
      OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
          validateInterval: TimeSpan.FromMinutes(30),
          regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
  }});
  </code></pre>
  
  <p>But I think it's for cookie-based authentication 
  Here is my code to configure token generation:</p>
  
  <pre><code>var oAuthServerOptions = new OAuthAuthorizationServerOptions()
              {
                  AllowInsecureHttp = true,
                  TokenEndpointPath = new PathString("/api/token"),
                  AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
                  Provider = provider,
                  RefreshTokenProvider = new SimpleRefreshTokenProvider()
              };
  </code></pre>
  
  <p>I have implemented my provider to check user credentials and refresh token provider to achieve sliding access token expiration.</p>
  
  <p>My first question is how to implement rejecting the access token/refresh token to sign the user out by checking securitystamp?.</p>
  
  <p>My second question Should I do it inside my access token provider and/or refresh token provider(if there is any code snippt it would be better to understand)?</p>