title: Destroy token in Token-based Authorization in Web API after user signs out
body: <p><strong>My requirements</strong> </p>
  
  <p>I have a Web API which gives me required data from the database. I have a .Net website which consumes this Web API to get all data. Now the requirement is to protect the APIs from being exposed to anyone on the web.</p>
  
  <p><strong>What I have done so far:</strong></p>
  
  <p><em>On the website:</em></p>
  
  <p>I generate a token when the user logs in. This token holds the details like username, a random key and the expiration time of the token, all in an encrypted string.</p>
  
  <p><em>On the API:</em></p>
  
  <p>Upon every request, before sending the response, I decrypt the token and validate if the username, key and expiration time are valid. If all of them are valid, the response will be sent. Otherwise, an error message is sent in response. 
  This is the function that I made changes in:</p>
  
  <pre><code>protected override Task&lt;HttpResponseMessage&gt; SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
          {
              AuthenticationHeaderValue authorization = request.Headers.Authorization;
              if (authorization != null)
              {
                  if (Encryption.DecryptData(token).Equals(ConfigurationManager.AppSettings["TokenKey"].ToString()))
                  {
                      //Send response
                  }
  
              }
          }
  </code></pre>
  
  <p>Everything is good till here.</p>
  
  <p><strong>Now the problem is...</strong></p>
  
  <p>Let us say that I put an expiration time of 15 minutes for the token. The generated token hence can be used for 15 minutes after login to get responses from the API.
  This token can be used irrespective of the user's login status i.e, the token is valid for 15 minutes even if the user signs out immediately after logging in.</p>
  
  <p>I have been brainstorming and searching for solutions for the past few days and I came across the thought of handling the data in sessions but found later that it is a bad idea with respect to scalability.</p>
  
  <p>There are also constraints that I cannot use OWIN. Additionally, the project is not MVC, it is a Web API project.</p>
  
  <p>Can someone please come to my rescue and point me towards a solution? I'll be grateful as this has already consumed a lot of time.</p>