[OAUTH-WG] token revocation from a different client

[Jaap Francke]

Hi all,

It’s only since recently that I’m sticking my nose deeper into the various OAUTH (draft) specifications.
I also recently joined this mailing list.
I have a question and I hope someone can help me.

I’ve been looking for a mechanism/endpoint/specification for token revocation.

RFC7009 is aimed at token revocation by the client itself - logoff is the typical use case.
What I’m looking for is a possibility for the enduser (resource owner) to revoke one of his tokens from a different client.

Use cases for this would be:
- suspection that password is compromised, so enduser wants to change his password and terminate all sessions on any device. For such devices to regain access, they would need the new password.
- stolen/lost device; the enduser should be able to revoke specific access/refresh-tokesn that have been issued for the stolen/lost device.

Any thoughts on this?

Thanks in advance,

Jaap Francke
Product Manager iWelcome

[Thomas Broyer]

Post by Jaap Francke
Hi all,
It’s only since recently that I’m sticking my nose deeper into the various
OAUTH (draft) specifications.
I also recently joined this mailing list.
I have a question and I hope someone can help me.
I’ve been looking for a mechanism/endpoint/specification for token revocation.
RFC7009 is aimed at token revocation by the client itself - logoff is the typical use case.
What I’m looking for is a possibility for the enduser (resource owner) to
revoke one of his tokens from a different client.
- suspection that password is compromised, so enduser wants to change his
password and terminate all sessions on any device. For such devices to
regain access, they would need the new password.
- stolen/lost device; the enduser should be able to revoke specific
access/refresh-tokesn that have been issued for the stolen/lost device.
Any thoughts on this?

That's outside the scope of OAuth I'm afraid.

If the AS is the same as the one where the user does those actions, and
then it's entirely internal (RFC6749/6750 define how clients are "notified"
of it – their token is rejected with invalid_token error code).
If the application allowing the user to do these actions is a special kind
of client to the AS, then there'll likely be APIs it can use to list
current tokens and authorization grants and allow to revoke them, or revoke
all of them at once. In any case, it'd be a special API that either would
require a specific scope (that you'd likely only grant to that client) or
would allow access based on the client only (either using client
credentials, or looking at the

There might exist specifications for such APIs already, but I'm not aware
of them (i.e. probably not from the OAuth WG)