OAuth Implementation - Revoke access tokens

0
votes

We have implemented the below process for revoking OAuth access tokens / refresh tokens to de-link an external app from our application.

  • On logout / user initiated de-linking action, we delete the access token and refresh token that was obtained from the initial authorization flow

  • User has to go through the authorization flow again once again to obtain the access token and refresh token

  • We are not calling any token revoke function / API call to the authorization server

My question is:

  • Does the authorization server automatically revoke the first set of access token + refresh token if a new authorization flow has been initiated by our app?

  • Are there any potential pitfalls to avoid in this approach?

The reason we took this approach is because most 3rd party apps do not offer revoke access related APIs and require the user to go to the 3rd party app to remove access / de-link the authorized apps.

1
oauthoauth-2.0access-tokenrefresh-token

1 Answers

0
votes

Does the authorization server automatically revoke the first set of access token + refresh token if a new authorization flow has been initiated by our app?

No, most won't. Consider a scenario where a user is logged into your application from multiple devices. Each would get a valid access/refresh token.

So, you can't rely on this.