The revocation window
You press sign out everywhere the moment you spot a stolen login. How long does the thief's copy keep working?
A login has been copied. You revoke it at the front desk, which stops new badges at once, but the thief already holds a short badge that checks itself. The panels show how long that copy keeps opening doors, the trips everyone makes for fresh badges, and the reads a crossed-out list would cost.
Board: Authentication →On a narrow screen the three panels stack below the dials, and the table scrolls sideways.
try this Drag How long a badge lives from an hour to 15 minutes and watch the refreshes and the thief's window move.
Each signed-in app makes 2 requests a minute and a working day is eight hours: teaching values. Revoking means crossing out the refresh token at the front desk, which always works at once; the dials decide how long the access token already in the thief's hands keeps working.
The thief's copy
15 min
longest a copied badge still opens doors after you revoke
A copied badge minted just before you revoke keeps opening doors for 15 min; on average, 7.5 min.
Trips to the front desk
111 /s
refreshes, every second, across everyone signed in
32 refreshes per person in an eight-hour day.
Reads at the doors
0 /s
reads of the crossed-out list
Out of 3,333 /s requests reaching the doors.
The lifetime dial, swept
Every lifetime, with the current check and the current number of people.
| Lifetime | Thief's copy works for | Refreshes | Per person per day | List reads |
|---|---|---|---|---|
| 1 min | 1 min | 1,667 /s | 480 | 0 /s |
| 2 min | 2 min | 833 /s | 240 | 0 /s |
| 5 min | 5 min | 333 /s | 96 | 0 /s |
| 10 min | 10 min | 167 /s | 48 | 0 /s |
| 15 min | 15 min | 111 /s | 32 | 0 /s |
| 30 min | 30 min | 56 /s | 16 | 0 /s |
| 1 h | 1 h | 28 /s | 8 | 0 /s |
| 4 h | 4 h | 6.9 /s | 2 | 0 /s |
| 1 day | 1 day | 1.2 /s | 0.3 | 0 /s |
You cut the access-token lifetime from an hour to fifteen minutes, with the same people signed in. How many trips to the front desk for fresh badges now?
One dial, two ends
A badge that checks itself cannot be called back. Whatever lifetime you print on it is how long a copy keeps working after you revoke the login behind it. At an hour that is up to 1 h; at five minutes, up to 5 min.
Every expiry is a trip to the front desk. For 100,000 people that is 28 /s at an hour and 333 /s at five minutes. The window times the trip rate is the same number at every setting: you choose which half to pay. Slide the check to the list and the window closes completely, but now every request asks the list, and requests outnumber refreshes at every lifetime on the dial.
Limits of this model
Worst case and average. A copied badge could have been minted any time in its life. The big number is the worst case, minted just before you revoke; the average is half the lifetime.
The refresh token is assumed revoked. If a thief also holds a refresh token that nobody crosses out, the window is the refresh token's life, often weeks. Rotation, from the lesson, is what catches that.
Requests and users are teaching values. Real apps send bursts, and many list reads hit a cache. The ratio between list reads and refreshes is what carries over, not the absolute numbers.