The access tokens are passed by reference (introspection endpoint).
I'm using IdentityServer's authentication handler for protecting my API.
How am I able to revoke an access token for a given user from my API?
I can easily do the above by invoking GetTokenAsync("access_token") to fetch the current user's access token, followed by making a request to the revocation endpoint hosted on my Identity Provider (Identity Server 4). But this only works if I want to revoke the user making the request, not another user.
I thought about fetching the access token from the database (for the given user), but they are not stored in plain-text. (I'm using a PersistedGrantStore implementation which stores the tokens in some encrypted form in a separate database. I'm not sure how they are being encrypted.)