Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on:

  1. is this true / is the end-user the one to revoke the token?
  2. can you point me to a tool / code / script or even a discussion on how the end-user could do that?

thanks!

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Unlike the resource owner credentials, tokens can be issued with a restricted scope and limited lifetime, and revoked independently.

from http://tools.ietf.org/html/rfc5849

I guess the RFC has also example, but I did browse it entirely. The oauth site also feature some code, maybe it can help you, http://oauth.net/code/

share|improve this answer
1  
thanks but still the code i couldn't find any. I am interested as well in how others have implemented it even if the code is not available. –  Stefany Jul 12 '11 at 20:17
add comment

It's a good to have option for the end-users, although the protocol does not mandate this possibility. Imagine the following scenario:

The end-user starts to use an application that wants to access his google account data. So the end-user is redirected to google to approve the request. Once he approves the request, google issues access token to the third party application. Now the third party application can get end-users's google data. However, after 5 minuties of using this application, the user changes his mind about it, and decides that this application is suspicious, not trustworthy or he just does not like it. So he goes to google accounts, more specifically here: https://www.google.com/accounts/IssuedAuthSubTokens

And he can revoke the access token for that application. That means, that this token is just invalidated or deleted from google database, and the application will no longer be able to get end-user's google account data.

You don't need to see specific code in order to do this. If you are a OAuth provider, you surely have a DB table with tokens that are associated with a particular user id.

token <-> user_id

You then make a simple page, which does the following when your user visit it:

It sees which user id is visiting the page and selects all the tokens for that user from the database and display a simple link - revoke token next to each token. After the user click revoke token, you simply delete it :)

It's not rocket science at all and is a good option to have.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.