Logout

[wellingtonoliveira96]

Hello,

It's my first time working with ouath and the oauth2-client. I couldn't find anything about user logout in the library docs.

I'm using the GenericProvider to connect using a work routes for authentication(there isn't a own provider). So in the docs of my work oauth guide they talk about a logout using a combination of:

url + token_hint + the return page. Where:

The url is the route of logout
The token_hint is the token of the user, used to eliminate the requirement of logout confirmation by the user
The return page is the page that will load in case of well succeded logout

I've tried some implementations but I didn't have success in the implementation.

[ramsey]

I don't believe OAuth itself defines any kind of logout functionality, which is why oauth2-client doesn't provide any logout mechanisms. Tokens either expire or they don't. If they do expire, OAuth provides a mechanism to refresh them, but not all providers implement token refresh.

If OAuth did define a logout, it would probably involve some manner of making a request to immediately invalidate the token so that it can't be reused on subsequent requests. Many services already provide this kind of functionality, but the user would need to log in to their account at the provider to revoke the tokens issued to other services. Most services (I've seen) do not provide token revocation through their APIs.

[sjordan1975]

@ramsey
Added as a point of discussion

I've just started implementing OAuth integration with the Calendly API and they do provide a token revoke endpoint in their API (see https://developer.calendly.com/api-docs/0c80c89b5e2e1-revoke-access-refresh-token).

Might revoke be up for consideration in the client library?