How can an access token be canceled or revoked in a system?

The cancellation or revocation of an access token depends on how they are stored and the authentication system implementation.

Main approaches:

1. Revocation list (blacklist) — store a list of revoked tokens on the server and check each request against this list.

2. Short token lifespan — make access tokens with a short lifetime so they expire quickly.

3. Using refresh tokens — when a refresh token is revoked, the user cannot obtain a new access token.

4. Changing secret keys or data used to generate tokens — for example, changing the "token version" field in the database and checking it during token validation.

Example with a blacklist in Python (simplified):

revoked_tokens = set()

def revoke_token(token):
    revoked_tokens.add(token)

def is_token_valid(token):
    if token in revoked_tokens:
        return False
    # additional signature and expiry check
    return True

Thus, to revoke a token, it is added to the revoked list or validation conditions are changed.