Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[oauth2] refresh tokens must not be used after user consents revocation #4039

Closed
tcompiegne opened this issue Jun 30, 2020 · 1 comment · Fixed by gravitee-io/gravitee-access-management#862
Closed

[oauth2] refresh tokens must not be used after user consents revocation #4039

tcompiegne opened this issue Jun 30, 2020 · 1 comment · Fixed by gravitee-io/gravitee-access-management#862
Assignees
@jhaeyaert
Labels
project: AM type: feature
Milestone
AM - 3.1.0

Comments

@tcompiegne
Copy link
Member

Currently AM do that to check if a refresh token is still valid :

  • the authorization server has revoked the refresh token
  • the refresh token has expired

We should also check if :

  • the user has revoked their consent for authorization
@tcompiegne tcompiegne added this to the AM - backlog milestone Jun 30, 2020
@jhaeyaert jhaeyaert self-assigned this Jul 2, 2020
@jhaeyaert
Copy link

After discussion, we agreed that when user revokes an application or a single permission (from Authorized apps screen), we will revoke both all the existing refresh_token and access_token.

jhaeyaert added a commit to gravitee-io/gravitee-access-management that referenced this issue Jul 6, 2020
@jhaeyaert
feat(revoke-tokens): revoke access and refresh tokens when consent is…
d020b51 
… revoked

Closes gravitee-io/issues#4039
@jhaeyaert jhaeyaert mentioned this issue Jul 6, 2020
Merged
@tcompiegne tcompiegne modified the milestones: AM - backlog, AM - 3.1.0 Jul 6, 2020
tcompiegne pushed a commit to gravitee-io/gravitee-access-management that referenced this issue Jul 6, 2020
@jhaeyaert @tcompiegne
feat(revoke-tokens): revoke access and refresh tokens when consent is…
838d8bb 
… revoked

Closes gravitee-io/issues#4039
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jhaeyaert jhaeyaert

Labels
project: AM type: feature
Projects
None yet
Milestone
AM - 3.1.0
2 participants
@tcompiegne @jhaeyaert