We need to revoke both access and refresh tokens from the resource servers in a generic way. One use case is to revoke tokens in the back-end when the user logs out in front-end.
Implement a solution that is compliant with the specification RFC 7009. The PHP library we are using already has an issue for token revocation with a pull request.
Needs work
5.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
If it's helpful to others, we recently updated the
Simple OAuth Revoke →
module which just adds the /oauth/revoke route as outlined by the RFC 7009.
(Note: The patch in this issue also adds an /oauth/logout endpoint; that's not part of the RFC 7009 spec so it's not in the Simple OAuth Revoke module.)