asp.net mvc - Refresh token doesn't fail after deleting the user -

i'd know if it's failure or bug/feature of asp.net identity.

we use asp.net identity 1.0 in our asp.net mvc 5 project. oauth configured this:

public partial class startup {     static startup()     {         publicclientid = "self";          usermanagerfactory = () => new usermanager<applicationuser>(new userstore<applicationuser>(new applicationdbcontext()));          oauthoptions = new oauthauthorizationserveroptions         {             tokenendpointpath = new pathstring("/token"),             provider = new applicationoauthprovider(publicclientid, usermanagerfactory),             refreshtokenprovider = new authenticationtokenprovider()             {                 oncreate = createrefreshtoken,                 onreceive = receiverefreshtoken             },             authorizeendpointpath = new pathstring("/api/account/externallogin"),             accesstokenexpiretimespan = timespan.fromdays(14),             allowinsecurehttp = true         };     }      public static oauthauthorizationserveroptions oauthoptions { get; private set; }      public static func<sphusermanager> usermanagerfactory { get; set; }      public static string publicclientid { get; private set; }      // more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?linkid=301864     public void configureauth(iappbuilder app)     {         // enable application use cookie store information signed in user         app.usecookieauthentication(new cookieauthenticationoptions         {             authenticationtype = defaultauthenticationtypes.applicationcookie,             loginpath = new pathstring("/login")         });          // use cookie temporarily store information user logging in third party login provider         app.useexternalsignincookie(defaultauthenticationtypes.externalcookie);          // enable application use bearer tokens authenticate users         app.useoauthbearertokens(oauthoptions);     }      private static void createrefreshtoken(authenticationtokencreatecontext context)     {         context.settoken(context.serializeticket());     }     private static void receiverefreshtoken(authenticationtokenreceivecontext context)     {         context.deserializeticket(context.token);     } } 

we use web api register , login user. refresh token used refresh access token. didn't expect:

1. register user
2. login user , obtain access token , refresh token (/token, grant_type=password...)
3. delete user (directly database or in administration).
4. call refresh token , request not fail. access token prolonged , user still authenticated (/token, grant_type=refresh_token...)

is correct behavior? should special "invalidate" tokens?

refresh token supports in katana oauth2 middleware you, if delete user it's logic revoke (delete) refresh tokens user.