Example: How to I deauthorize a token?

[jeffblake]

Many OAuth providers have the ability to disconnect a token. E.g.:

Quickbooks:
https://developer.intuit.com/docs/0150_payments/0060_authentication_and_authorization/oauth_management_api

Stripe:
https://stripe.com/docs/connect/reference

Is there a roadmap for integrating this into the oauth2 gem?

[xtagon]

Is this the same as #244?

[pboling]

Yes, this is the same as #244. This one was opened first, so closing the other.

[pboling]

Ref from the closed #244 - http://tools.ietf.org/html/rfc7009

[ionutzp]

👍

[nunosilva800]

Looking into this because I want to programmatically revoke depending on some conditions.
For the Google provider, for example, they inform the following:

# To programmatically revoke a token, make an HTTP request to the oauth2.revoke endpoint:

uri = URI('https://accounts.google.com/o/oauth2/revoke')
params = { :token => auth_client.access_token }
uri.query = URI.encode_www_form(params)
response = Net::HTTP.get(uri)

https://developers.google.com/identity/protocols/OAuth2WebServer#tokenrevoke

---

So, I was looking into the source code and found that we can just do the following:

# Instantiate the token
token = OAuth2::AccessToken.new(omniauth_strategy.client, access_token, refresh_token: refresh_token)

# revoke
token.post('/o/oauth2/revoke', params: { token: user.refresh_token })

I'm using the gems omniauth and omniauth-google-oauth2, but that should not matter.
Seems simple enough for anyone to do this, but let me know if it's still worth it's own method, very much like the refresh method.

[pboling]

Thanks for the tips! We should get that idea into documentation if it isn't already, as it seems to be a frequent question. Leaving this open until we get it documented (aside from here in the issue tracker).