Sync session persistence after server-side credential revocation

Answer

p>The expected timeframe for a revoked session to trigger a re-authentication prompt is dependent on the token's internal Time-to-Live (TTL) and the next synchronization cycle. The browser does not typically perform a real-time validity check before every sync operation; instead, it relies on the locally stored OAuth token until the server returns a 401 Unauthorized or 403 Forbidden error, or the token expires naturally.

In the current architecture, session persistence occurs because stateless tokens are self-contained. If a session is revoked via the account management portal, the server invalidates the session entry. However, the local browser instance may continue to operate under the previous token until it attempts to refresh the token or perform a sync operation that requires server-side validation.

Confirmed Facts

• Stateless Tokens: Opera utilizes OAuth-based tokens that remain valid until their defined expiration date, regardless of account status, unless the server explicitly rejects them.
• Sync Cadence: The browser triggers sync operations at specific intervals. If a revocation occurs between intervals, the local session remains active until the next scheduled sync.
• Refresh Token Rotation: If the refresh token is revoked, the browser cannot obtain a new access token once the current one expires, effectively forcing a re-authentication prompt.

Likely Explanation for Latency

The latency gap is a result of the distributed nature of OAuth implementations. To maintain performance and reduce server overhead, the browser avoids a "phone home" check for every minor data mirror. The "ghost session" persists because the client assumes the token is valid based on its internal TTL until a server-side rejection is encountered during a write or a-refresh request.

Steps to Verify and Mitigate

1. Check Token Expiry: Inspect the browser's internal state or local storage to find the timestamp for the stored access token.
2. Force a Sync: Manually trigger a synchronization operation through the browser settings. If the session is revoked, the server will return an error, triggering the login prompt.
3. Monitor Network Logs: Use browser developer tools or internal logs to look for 401 or 403 responses during sync requests, which confirms the server has invalidated the token.
4. Clear Local Storage: For immediate termination, clearing the browser's local storage for the Opera sync domain will remove the tokens and force a login.

To provide a more specific recommendation, could you confirm if the revocation was performed via the "account revocation" feature or by changing the account password? Password changes typically invalidate refresh tokens more aggressively than standard revocation.