title: How do you prevent replay attacks with Thinktecture IdentityModel token?
body: <p>I have two sites on separate domains.  I'm implementing SSO using the Thinktecture IdentityModel.</p>
  
  <p>A user logs into Site A.  At some point they click a link to take them to site B.  Site A redirects the user to site B/Login.aspx?token=&lt; token > with a JWT token.  Site B then validates the token by calling an API on Site A to authenticate the user. If authenticated, the user is automatically logged into site B.</p>
  
  <p>By default Thinktecture tokens last for 10 hours, with no way to kill a token(as far as I can tell). If the user logs out of the site, the token is still valid.  I can look at the browser history and get the "Login.aspx?token=&lt; token >" url and be automatically logged back in. Is there a way to kill all of a users tokens when they logout? Should the token not be passed as part of the querystring?  What is the best way to prevent a replay attack?  </p>