oauth/revoke endpoint doesn't revoke expired access tokens

[ShalaQweghen]

Steps to reproduce

When an access token is expired, it cannot be revoked with oauth/revoke endpoint. It seems like it can cause security issues if refresh tokens are enabled because refresh tokens attached to expired access tokens can still be used to obtain new access tokens.

As an example case; an application which interacts with my doorkeeper app uses refresh tokens to get new access tokens when an access token expires. When the interacting application is uninstalled from a user's computer, it makes a request to oauth/revoke to take care of the access token. However, because the token expired before uninstalling the application, oauth/revoke endpoint doesn't do anything to it. So, in theory, it can be used to get new access tokens.

I have temporarily overcome this by overriding tokens controller as follows:

# routes.rb
...
  use_doorkeeper do
    controllers tokens: 'oauth/tokens'
  end
...

class Oauth::TokensController < Doorkeeper::TokensController
  private

  def revoke_token
    token.revoke unless token&.revoked?
  end
end

Expected behavior

Making a request to oauth/revoke should revoke an access token even it is expired.

Actual behavior

Making a request to oauth/revoke doesn't revoke expired access tokens.

System configuration

The configuration is pretty much the same as the default with a couple of modifications which don't affect the oauth/revoke endpoint.

Ruby version: 3.0.4

[nbulaj]

Hey thanks @ShalaQweghen . I have to check what OAuth RFC says about such case at first

[nbulaj]

Well, at first sight no recommendations and restrictions

• https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
• https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens

Also are you sure it's possible to use expired token to get a new token? 🤔 Can you provide an RSpec example please?

[nbulaj]

Also nothing in OAuth 2.0 Threat Model and Security Considerations ( https://datatracker.ietf.org/doc/html/rfc6819 )

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[syakovyn]

I have the same issue @ShalaQweghen mentioned. However, it is not about revoking expired access tokens which is not an issue but revoking refresh tokens. E.g. if a request is made to revoke a refresh token that is bound to an expired access token the refresh token remains intact. As a result, it can be used to get one new access token or even multiple access tokens in refresh_token_revoked_on_use mode after it was "revoked".