Try to revoke on `GetAuthenticatedUser` method.

framework/src/Volo.Abp.AspNetCore.Components.WebAssembly/Volo/Abp/AspNetCore/Components/WebAssembly/WebAssemblyAuthenticationStateProvider.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Concurrent;
 using System.Linq;
 using System.Net.Http;
+using System.Security.Claims;
 using System.Text.Json.Serialization;
 using System.Threading.Tasks;
 using IdentityModel.Client;
@@ -62,6 +63,19 @@ public class WebAssemblyAuthenticationStateProvider<TRemoteAuthenticationState,
         };
     }
 
+    protected async override ValueTask<ClaimsPrincipal> GetAuthenticatedUser()
+    {
+        var accessToken = await FindAccessTokenAsync();
+        if (!accessToken.IsNullOrWhiteSpace())
+        {
+            AccessTokens.TryAdd(accessToken, accessToken);
+        }
+
+        await TryRevokeOldAccessTokensAsync();
+
+        return await base.GetAuthenticatedUser();
+    }
+
     public async override Task<AuthenticationState> GetAuthenticationStateAsync()
     {
         var state = await base.GetAuthenticationStateAsync();