Invalidate token on closing all browser tabs in a JavaScript application

invalidate-token.js

function manageLoginSession() {
    let totalTabs: number;

    window.onload = function(e) {
      let accessToken = sessionStorage.getItem("accessToken");
      let refreshToken = sessionStorage.getItem("refreshToken");
      let expiresAt = sessionStorage.getItem("expiresAt");
      if (accessToken !== null && refreshToken !== null && expiresAt !== null) {
        localStorage.setItem("accessToken", accessToken);
        localStorage.setItem("refreshToken", refreshToken);
        localStorage.setItem("expiresAt", expiresAt);
        sessionStorage.removeItem("accessToken");
        sessionStorage.removeItem("refreshToken");
        sessionStorage.removeItem("expiresAt");
      } 
      if (localStorage.getItem("count") === null) {
        totalTabs = 0;
      } else {
        totalTabs = parseInt(localStorage.getItem("count"));
      }
      totalTabs++;
      localStorage.setItem("count", "" + totalTabs);
    }
    
    window.onbeforeunload = function(e){
    
      if (localStorage.getItem("count") === null) {
        totalTabs = 1;
      } else {
        totalTabs = parseInt(localStorage.getItem("count"));
      }
      totalTabs--;
      localStorage.setItem("count", "" + totalTabs);
      if (totalTabs < 1) {
        let accessToken = localStorage.getItem("accessToken");
        let refreshToken = localStorage.getItem("refreshToken");
        let expiresAt = localStorage.getItem("expiresAt");
        if (accessToken !== null && refreshToken !== null && expiresAt !== null) {        
          sessionStorage.setItem("accessToken", accessToken);
          sessionStorage.setItem("refreshToken", refreshToken);
          sessionStorage.setItem("expiresAt", expiresAt);
        }
        localStorage.removeItem("accessToken");
        localStorage.removeItem("refreshToken");
        localStorage.removeItem("expiresAt");
      }
    }
  }

It's not invalidating token. It simply removes the token from browser memory without invalidating it. :(

Actually, from the client side, token invalidation is not possible. Only authorization server can invalidate it. I am not sure, which authorization provider you are using, but perhaps you can call the invalidate / logout endpoint along with clearing the token information if the authorization provider has any.