Token revocation when server side sessions are enabled

[josephdecock]

We use extensibility points in the cookie handler to do two things when sessions end:

• delete the server side session (via our ITicketStore implementation) and
• revoke refresh tokens (via our PostConfigureApplicationCookieRevokeRefreshToken configuration)

These two features don't work together, because the cookie handler orchestrates them in the wrong order: it destroys the session (and the token with it) before it attempts to revoke the token, so revocation never occurs.

Need to investigate the best way to solve this.
Ideas:

• Revoke refresh tokens from within the ticket or user session store
• Revoke refresh tokens in the bff/logout endpoint
• Consider if the SessionRevocationService (used on backchannel logout) can help.